ffffffffffff0020044b2b14ce7e3c19acf98157fc853bb5a698735c1d3d3a659daf3f558924e12838d3536bdd961c78631fc60f24bfe646d996ffc4b25f79c57402ee06ebaf018ba336b3b6bb5f742a7706c5cea80d534d1510c2d1d55fa0d00d948ec09f0204c03d7ea22deba10031483506e7e8d5f233d483c8a2b8f87e5c7043661dc19c1db520199daa7e8eb6d5a3bea3ea4056a8db5764e4a74cd2e1f82f01d2ff14f112f012de43cd644506d9592277a61a553a1400"/203], 0x1c}}, 0x0) [ 3382.587408] Unknown ioctl 1074024961 [ 3382.599032] Unknown ioctl 1074024961 [ 3382.612790] Unknown ioctl 1074024961 09:00:55 executing program 5: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x0) [ 3382.638584] Unknown ioctl 1074024961 [ 3382.657971] Unknown ioctl 1074024961 [ 3382.673215] Unknown ioctl 1074024961 [ 3382.684812] Unknown ioctl 1074024961 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:00:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000300fa14a95884d3eed466ed0c34eed1dac54832155b574f7f51fc83159f00000500df60779425a2067c1f882dc4c7bf6327ad69c25d321583f32d1e4b6e62659807f31ee86c2ebc404ccd3dd3bbce1b87b067e6976e617670138bce9c3208fc39fedc144635b290413002781b464fc30ea33c7d724675b7960c0c4cde789dc57060f1e5ce4fccb3ab3aef55d8efcb56b7cd932fa9dc0b099c5729335885cdfa67748a0545bac3af89df496c88aee375b3a19c4f80b2fb10f9d69fcb8d1cbcb41a837b461eee50dcf4f08bd54cf6a3f6f404c7b006007250c8e3410cbba733cbe46a051231361fb780eb2da8498450085fcdd093c076f0354114de0c0a4f4e0cd7035057168e6cfa81477eb2dc7d5c40fc3ab2c085c468baab1b277f1046fbc6705ffd890f45e316523aca24ef966b878f8b1f"], 0x1c}}, 0x0) 09:00:56 executing program 3: connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000d509f21f03c296dfc184445e96872c97e0444a733c243d25a549efde310d2f435581f38b939c953afa4acc3b1f3cb08f79c59f64f14e75350e028a8e42d10b2af4cf07417c10e6c78e11a1714584296db6bf27cbd24c2e9d5e21", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$RTC_PIE_ON(r2, 0x7005) [ 3382.691922] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 3382.693840] Unknown ioctl 1074024961 [ 3382.715645] Unknown ioctl 1074024961 [ 3382.722435] Unknown ioctl 1074024961 [ 3382.727038] Unknown ioctl 1074024961 [ 3382.735105] Unknown ioctl 1074024961 09:00:56 executing program 1: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000000)={0x40, 0xc56c}) syz_open_dev$loop(&(0x7f0000000040), 0x100003b, 0xda543) [ 3382.746841] Unknown ioctl 1074024961 [ 3382.755146] Unknown ioctl 1074024961 [ 3382.765603] Unknown ioctl 1074024961 [ 3382.780632] Unknown ioctl 1074024961 [ 3382.794287] Unknown ioctl 1074024961 [ 3382.811333] Unknown ioctl 1074024961 [ 3382.823429] Unknown ioctl 1074024961 [ 3382.830788] Unknown ioctl 1074024961 [ 3382.836008] Unknown ioctl 1074024961 [ 3382.842409] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 3382.844696] Unknown ioctl 1074024961 [ 3382.854933] Unknown ioctl 1074024961 [ 3382.858771] Unknown ioctl 1074024961 [ 3382.862554] Unknown ioctl 1074024961 [ 3382.866354] Unknown ioctl 1074024961 [ 3382.873500] Unknown ioctl 1074024961 [ 3382.877274] Unknown ioctl 1074024961 [ 3382.881612] Unknown ioctl 1074024961 [ 3382.885565] Unknown ioctl 1074024961 [ 3382.894785] Unknown ioctl 1074024961 [ 3382.902609] Unknown ioctl 1074024961 [ 3382.906339] Unknown ioctl 1074024961 [ 3382.910103] Unknown ioctl 1074024961 [ 3382.913805] Unknown ioctl 1074024961 [ 3382.917498] Unknown ioctl 1074024961 [ 3382.921529] Unknown ioctl 1074024961 [ 3382.925237] Unknown ioctl 1074024961 [ 3382.929000] Unknown ioctl 1074024961 [ 3382.932697] Unknown ioctl 1074024961 [ 3382.936386] Unknown ioctl 1074024961 [ 3382.940560] Unknown ioctl 1074024961 [ 3382.944275] Unknown ioctl 1074024961 [ 3382.948322] Unknown ioctl 1074024961 [ 3382.952036] Unknown ioctl 1074024961 [ 3382.955740] Unknown ioctl 1074024961 [ 3382.959504] Unknown ioctl 1074024961 [ 3382.963207] Unknown ioctl 1074024961 [ 3382.966895] Unknown ioctl 1074024961 [ 3382.970673] Unknown ioctl 1074024961 [ 3382.974373] Unknown ioctl 1074024961 [ 3382.978145] Unknown ioctl 1074024961 [ 3382.981845] Unknown ioctl 1074024961 [ 3382.985535] Unknown ioctl 1074024961 [ 3382.989297] Unknown ioctl 1074024961 [ 3382.992994] Unknown ioctl 1074024961 09:00:56 executing program 4: clock_getres(0xfffffffffffffffe, 0x0) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f00000003c0)={0x3, 0x0}, 0x8) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000400)={r3}, 0x4) ioctl$KVM_S390_UCAS_UNMAP(r1, 0x4018ae51, &(0x7f0000000140)={0x101, 0x9, 0x2}) r4 = syz_open_dev$media(&(0x7f0000000c40), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f00000000c0)={0x80000000, &(0x7f0000000000)=[{}, {0x80000000, 0x0}], 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f00000002c0)={r5, 0x0, 0x0}) (async) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f0000000500)={r5, &(0x7f0000000440)=[{0x80000000}], &(0x7f0000000480)}) (async) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x2, 0x0, &(0x7f0000000540)=[{}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}], 0x6, 0x0, &(0x7f0000000680)=[{}, {0x0, 0x80000000}, {}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000740)=[{}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f0000000800)={{r8, r6, 0x5, [0x6, 0x232]}, {r7, r6, 0x2, [0x2, 0x5]}, 0x4, [0x4, 0x9]}) (async) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), r0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x60, r9, 0x208, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xff}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfff}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_BACKEND_IDENTIFIER={0xf, 0xa, '/dev/vsock\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040004}, 0x45811) (async, rerun: 64) syz_open_dev$mouse(&(0x7f0000000180), 0x1, 0x103000) (async, rerun: 64) r10 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$RNDADDTOENTCNT(r10, 0x40045201, &(0x7f0000000200)=0x1) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000001}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x54, 0x0, 0x300, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x5}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x100000001}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x883) 09:00:56 executing program 5: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x0) 09:00:56 executing program 1: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000000)={0x40, 0xc56c}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x100003b, 0xda543) 09:00:56 executing program 3: connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000d509f21f03c296dfc184445e96872c97e0444a733c243d25a549efde310d2f435581f38b939c953afa4acc3b1f3cb08f79c59f64f14e75350e028a8e42d10b2af4cf07417c10e6c78e11a1714584296db6bf27cbd24c2e9d5e21", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$RTC_PIE_ON(r2, 0x7005) 09:00:56 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000300fa14a95884d3eed466ed0c34eed1dac54832155b574f7f51fc83159f00000500df60779425a2067c1f882dc4c7bf6327ad69c25d321583f32d1e4b6e62659807f31ee86c2ebc404ccd3dd3bbce1b87b067e6976e617670138bce9c3208fc39fedc144635b290413002781b464fc30ea33c7d724675b7960c0c4cde789dc57060f1e5ce4fccb3ab3aef55d8efcb56b7cd932fa9dc0b099c5729335885cdfa67748a0545bac3af89df496c88aee375b3a19c4f80b2fb10f9d69fcb8d1cbcb41a837b461eee50dcf4f08bd54cf6a3f6f404c7b006007250c8e3410cbba733cbe46a051231361fb780eb2da8498450085fcdd093c076f0354114de0c0a4f4e0cd7035057168e6cfa81477eb2dc7d5c40fc3ab2c085c468baab1b277f1046fbc6705ffd890f45e316523aca24ef966b878f8b1f"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000300fa14a95884d3eed466ed0c34eed1dac54832155b574f7f51fc83159f00000500df60779425a2067c1f882dc4c7bf6327ad69c25d321583f32d1e4b6e62659807f31ee86c2ebc404ccd3dd3bbce1b87b067e6976e617670138bce9c3208fc39fedc144635b290413002781b464fc30ea33c7d724675b7960c0c4cde789dc57060f1e5ce4fccb3ab3aef55d8efcb56b7cd932fa9dc0b099c5729335885cdfa67748a0545bac3af89df496c88aee375b3a19c4f80b2fb10f9d69fcb8d1cbcb41a837b461eee50dcf4f08bd54cf6a3f6f404c7b006007250c8e3410cbba733cbe46a051231361fb780eb2da8498450085fcdd093c076f0354114de0c0a4f4e0cd7035057168e6cfa81477eb2dc7d5c40fc3ab2c085c468baab1b277f1046fbc6705ffd890f45e316523aca24ef966b878f8b1f"], 0x1c}}, 0x0) (async) 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async, rerun: 64) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) (rerun: 64) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) [ 3382.996685] Unknown ioctl 1074024961 [ 3383.000429] Unknown ioctl 1074024961 [ 3383.004125] Unknown ioctl 1074024961 [ 3383.007869] Unknown ioctl 1074024961 [ 3383.012177] Unknown ioctl 1074024961 [ 3383.015868] Unknown ioctl 1074024961 [ 3383.019627] Unknown ioctl 1074024961 [ 3383.023325] Unknown ioctl 1074024961 [ 3383.027028] Unknown ioctl 1074024961 09:00:56 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x80000000401) clock_getres(0xfffffffffffffffe, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SNDCTL_TMR_SELECT(r3, 0x40045408) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) 09:00:56 executing program 1: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000000)={0x40, 0xc56c}) syz_open_dev$loop(&(0x7f0000000040), 0x100003b, 0xda543) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) (async) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000000)={0x40, 0xc56c}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x100003b, 0xda543) (async) 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) (async) [ 3383.126572] Unknown ioctl 1074024961 09:00:56 executing program 3: connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000d509f21f03c296dfc184445e96872c97e0444a733c243d25a549efde310d2f435581f38b939c953afa4acc3b1f3cb08f79c59f64f14e75350e028a8e42d10b2af4cf07417c10e6c78e11a1714584296db6bf27cbd24c2e9d5e21", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$RTC_PIE_ON(r2, 0x7005) 09:00:56 executing program 5: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x0) [ 3383.174711] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 09:00:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x80402, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f00000000c0)={0x5, 0x7fff}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x5, 0x201) r1 = socket(0x3, 0x6, 0x8001) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x4}, 0x4) 09:00:56 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r1) sendmsg$FOU_CMD_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r0, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x24000800) [ 3383.217963] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 09:00:56 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x80000000401) clock_getres(0xfffffffffffffffe, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SNDCTL_TMR_SELECT(r3, 0x40045408) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x80000000401) (async) clock_getres(0xfffffffffffffffe, 0x0) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) (async) ioctl$SNDCTL_TMR_SELECT(r3, 0x40045408) (async) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) (async) 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@FOU_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:56 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4060000}, 0x4080) 09:00:56 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00042dbd7000fbdbdf250200000004000500040005005f50fe02787c381caeb4eafbfa39f5d751e923cec606a8abafb63739d94b588fd6ac3adef321fb6450ef09c188f8fdbe4484b8c38ce85b72920100000000000000d965f673962b2f3b8fd85031dc9d9284d800004270ef5fa9bd6989b1505a685f799a1eb029e57233514451c705a337b6e753cef11516"], 0x1c}, 0x1, 0x0, 0x0, 0x4000880}, 0xc000) 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@FOU_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:56 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r1) sendmsg$FOU_CMD_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r0, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x24000800) 09:00:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x80402, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f00000000c0)={0x5, 0x7fff}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) syz_open_dev$loop(&(0x7f0000000100), 0x5, 0x201) (async) r1 = socket(0x3, 0x6, 0x8001) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x4}, 0x4) 09:00:56 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4060000}, 0x4080) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4060000}, 0x4080) (async) 09:00:56 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00042dbd7000fbdbdf250200000004000500040005005f50fe02787c381caeb4eafbfa39f5d751e923cec606a8abafb63739d94b588fd6ac3adef321fb6450ef09c188f8fdbe4484b8c38ce85b72920100000000000000d965f673962b2f3b8fd85031dc9d9284d800004270ef5fa9bd6989b1505a685f799a1eb029e57233514451c705a337b6e753cef11516"], 0x1c}, 0x1, 0x0, 0x0, 0x4000880}, 0xc000) 09:00:56 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x80000000401) (async) clock_getres(0xfffffffffffffffe, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) (async) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SNDCTL_TMR_SELECT(r3, 0x40045408) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@FOU_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:56 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00042dbd7000fbdbdf250200000004000500040005005f50fe02787c381caeb4eafbfa39f5d751e923cec606a8abafb63739d94b588fd6ac3adef321fb6450ef09c188f8fdbe4484b8c38ce85b72920100000000000000d965f673962b2f3b8fd85031dc9d9284d800004270ef5fa9bd6989b1505a685f799a1eb029e57233514451c705a337b6e753cef11516"], 0x1c}, 0x1, 0x0, 0x0, 0x4000880}, 0xc000) 09:00:56 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4060000}, 0x4080) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4060000}, 0x4080) (async) 09:00:56 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x840, 0x0) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8804}, 0x20044045) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r3) ioctl$RTC_AIE_OFF(r3, 0x7002) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r5) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x4080) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000500)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x68, r7, 0x800, 0x1870bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x10000}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6e0f}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x81) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r4, @ANYBLOB="fbffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r8) 09:00:56 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r1) sendmsg$FOU_CMD_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r0, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x24000800) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000040), r1) (async) sendmsg$FOU_CMD_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r0, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x24000800) (async) 09:00:56 executing program 4: clock_getres(0x6, 0x0) 09:00:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x80402, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f00000000c0)={0x5, 0x7fff}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x5, 0x201) (async, rerun: 64) r1 = socket(0x3, 0x6, 0x8001) (rerun: 64) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x4}, 0x4) 09:00:56 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8d48a6f758dfe728, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x840, 0x0) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8804}, 0x20044045) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r3) ioctl$RTC_AIE_OFF(r3, 0x7002) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r5) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x4080) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000500)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x68, r7, 0x800, 0x1870bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x10000}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6e0f}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x81) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r4, @ANYBLOB="fbffffffff002004"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r8) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x840, 0x0) (async) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8804}, 0x20044045) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r3) (async) ioctl$RTC_AIE_OFF(r3, 0x7002) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r5) (async) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x4080) (async) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000500)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x68, r7, 0x800, 0x1870bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x10000}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) (async) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6e0f}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x81) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r4, @ANYBLOB="fbffffffff002004"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r8) (async) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES16=r1, @ANYRES64=r0], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 09:00:57 executing program 4: clock_getres(0x6, 0x0) clock_getres(0x6, 0x0) (async) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000016c0)={0xd4, 0x0, &(0x7f00000014c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/78, 0x4e, 0x2, 0x7}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/207, 0xcf, 0x2, 0xb}, @flat=@weak_handle={0x77682a85, 0x1000}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x400}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001440)={@ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/186, 0xba, 0x0, 0x3c}, @fda={0x66646185, 0x4, 0x2, 0x40000000006}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/4096, 0x1000, 0x2, 0x25}}, &(0x7f0000000140)={0x0, 0x28, 0x48}}}, @clear_death, @enter_looper, @free_buffer, @register_looper, @exit_looper, @dead_binder_done, @increfs], 0xde, 0x0, &(0x7f00000015c0)="bdd22c35f3f5ddf50ccf70cd51d798c61041679b082cdeb622f18c06bbf21a5db3218eda035b9d2b74b5661331e585d1e3822fe1b6450a237ee605f8cbe0beadbb0dd9095d084d8e722f16141c57f0f733648618b3892a386250c3fe73ccf27e6c32a180c76e57d9129f8a6a06d717b388b2c054c60ff6d64e8389974d7f23bfcec02b0f97769f2dd5bf244a0d1183df6f606517788e351b57603647cdd0464900b97dc82cb776303b2f9d0db1a35b6d9d3e986b925fa0317aeb0b449957ef83a45fef452fd008110f4814fa46e0252e92efff4d1add56951284b22eba75"}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000001700)={0xfffffffffffffffc}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001740), 0x8000, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000001780)={0xff}) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES16=r1, @ANYRES64=r0], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (rerun: 64) 09:00:57 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8d48a6f758dfe728, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000016c0)={0xd4, 0x0, &(0x7f00000014c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/78, 0x4e, 0x2, 0x7}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/207, 0xcf, 0x2, 0xb}, @flat=@weak_handle={0x77682a85, 0x1000}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x400}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001440)={@ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/186, 0xba, 0x0, 0x3c}, @fda={0x66646185, 0x4, 0x2, 0x40000000006}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/4096, 0x1000, 0x2, 0x25}}, &(0x7f0000000140)={0x0, 0x28, 0x48}}}, @clear_death, @enter_looper, @free_buffer, @register_looper, @exit_looper, @dead_binder_done, @increfs], 0xde, 0x0, &(0x7f00000015c0)="bdd22c35f3f5ddf50ccf70cd51d798c61041679b082cdeb622f18c06bbf21a5db3218eda035b9d2b74b5661331e585d1e3822fe1b6450a237ee605f8cbe0beadbb0dd9095d084d8e722f16141c57f0f733648618b3892a386250c3fe73ccf27e6c32a180c76e57d9129f8a6a06d717b388b2c054c60ff6d64e8389974d7f23bfcec02b0f97769f2dd5bf244a0d1183df6f606517788e351b57603647cdd0464900b97dc82cb776303b2f9d0db1a35b6d9d3e986b925fa0317aeb0b449957ef83a45fef452fd008110f4814fa46e0252e92efff4d1add56951284b22eba75"}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000001700)={0xfffffffffffffffc}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001740), 0x8000, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000001780)={0xff}) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000016c0)={0xd4, 0x0, &(0x7f00000014c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/78, 0x4e, 0x2, 0x7}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/207, 0xcf, 0x2, 0xb}, @flat=@weak_handle={0x77682a85, 0x1000}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x400}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001440)={@ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/186, 0xba, 0x0, 0x3c}, @fda={0x66646185, 0x4, 0x2, 0x40000000006}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/4096, 0x1000, 0x2, 0x25}}, &(0x7f0000000140)={0x0, 0x28, 0x48}}}, @clear_death, @enter_looper, @free_buffer, @register_looper, @exit_looper, @dead_binder_done, @increfs], 0xde, 0x0, &(0x7f00000015c0)="bdd22c35f3f5ddf50ccf70cd51d798c61041679b082cdeb622f18c06bbf21a5db3218eda035b9d2b74b5661331e585d1e3822fe1b6450a237ee605f8cbe0beadbb0dd9095d084d8e722f16141c57f0f733648618b3892a386250c3fe73ccf27e6c32a180c76e57d9129f8a6a06d717b388b2c054c60ff6d64e8389974d7f23bfcec02b0f97769f2dd5bf244a0d1183df6f606517788e351b57603647cdd0464900b97dc82cb776303b2f9d0db1a35b6d9d3e986b925fa0317aeb0b449957ef83a45fef452fd008110f4814fa46e0252e92efff4d1add56951284b22eba75"}) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000001700)={0xfffffffffffffffc}) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000001740), 0x8000, 0x0) (async) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000001780)={0xff}) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) (async) [ 3383.841903] Unknown ioctl 4735 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES16=r1, @ANYRES64=r0], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES16=r1, @ANYRES64=r0], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x840, 0x0) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8804}, 0x20044045) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r3) ioctl$RTC_AIE_OFF(r3, 0x7002) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r5) (async) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x4080) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000500)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x68, r7, 0x800, 0x1870bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x10000}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) (async) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6e0f}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x81) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r4, @ANYBLOB="fbffffffff002004"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r8) 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8d48a6f758dfe728, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:57 executing program 4: clock_getres(0x6, 0x0) 09:00:57 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) (async) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="84020008", @ANYRES16=r2, @ANYBLOB="08002bbd04000000000000000000240009800800010009000000080001008000000008000200870e00000800020001000000880001802c0004001400010002004e20e000000200000000000000001400020002004e210000000000000000000000000d0001007564703a73797a31000000000d0001007564703a73797a300000000038000400200001000a004e2000000000ff020000000000000000000000000001000400001400020002004e22ac14142f00000000000000004c0001802c0004001400010002004e24e000000200000000000000001400020002004e20ac1414aa00000000000000001c00028008000300ffffffff08000200080000000800020002000000b00004802400078008000400fcffffff0800040001000000080003000500000008000400ffffffff3400078008000100100000000800010003000000080001000000000008000200000400000800030087070000080001001a0000005400078008000200020000000800030003000000080001000f00000008000300030000000800040005000000080002000700000008000200b3fcffff080001000a00000008000400b1a2000008000300e30000000c00038008000300080000002c000380080002000700000008000300ff0700000800010001a30000080003000000000008000200040f0000100007800c0004000000000000000000400005803c0002800800030000010000080001001d000000080001000700000008000200030000000800040011060000080001000900000008000300070000004000078008000100982d00000c00040001000000000000000c00040002000000000000000c0003000000000000000000080002000100008008000100030000006b9f7cd9918ca4dfd5770161701b99baea8bed979a6cb74e5e0a04c4aafd7ee4235c1df8dc1a20afd92d2466dc966006edcb8607c8f3da7d6ab836b36640585afc24650e49fe34224dac9330e44a1ad5678d1942f237ddb5874efe1b0e92bff582ab7b12b220ac3ce25cc19bbcb6450efaf44e39647042efad4729e79229782926a26a7176a7f360076a4233e253c2b212a28bfe2d79e616eb4e3deef4264b66c4664177"], 0x284}, 0x1, 0x0, 0x0, 0x40000}, 0x2400c048) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f00000005c0)=0xf02) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES64=r1, @ANYRESDEC=r3, @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x10844}, 0x400c074) [ 3383.963507] Unknown ioctl 4735 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000100), &(0x7f0000000140)=[0x0], 0x0, 0x8, &(0x7f0000000180)=[{}], 0x8, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000016c0)={0xd4, 0x0, &(0x7f00000014c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/78, 0x4e, 0x2, 0x7}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/207, 0xcf, 0x2, 0xb}, @flat=@weak_handle={0x77682a85, 0x1000}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x400}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001440)={@ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/186, 0xba, 0x0, 0x3c}, @fda={0x66646185, 0x4, 0x2, 0x40000000006}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/4096, 0x1000, 0x2, 0x25}}, &(0x7f0000000140)={0x0, 0x28, 0x48}}}, @clear_death, @enter_looper, @free_buffer, @register_looper, @exit_looper, @dead_binder_done, @increfs], 0xde, 0x0, &(0x7f00000015c0)="bdd22c35f3f5ddf50ccf70cd51d798c61041679b082cdeb622f18c06bbf21a5db3218eda035b9d2b74b5661331e585d1e3822fe1b6450a237ee605f8cbe0beadbb0dd9095d084d8e722f16141c57f0f733648618b3892a386250c3fe73ccf27e6c32a180c76e57d9129f8a6a06d717b388b2c054c60ff6d64e8389974d7f23bfcec02b0f97769f2dd5bf244a0d1183df6f606517788e351b57603647cdd0464900b97dc82cb776303b2f9d0db1a35b6d9d3e986b925fa0317aeb0b449957ef83a45fef452fd008110f4814fa46e0252e92efff4d1add56951284b22eba75"}) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000001700)={0xfffffffffffffffc}) (async) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001740), 0x8000, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000001780)={0xff}) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000000)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x9b85, 0x40000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) clock_getres(0xfffffffffffffffe, 0x0) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:57 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) (async) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="84020008", @ANYRES16=r2, @ANYBLOB="08002bbd04000000000000000000240009800800010009000000080001008000000008000200870e00000800020001000000880001802c0004001400010002004e20e000000200000000000000001400020002004e210000000000000000000000000d0001007564703a73797a31000000000d0001007564703a73797a300000000038000400200001000a004e2000000000ff020000000000000000000000000001000400001400020002004e22ac14142f00000000000000004c0001802c0004001400010002004e24e000000200000000000000001400020002004e20ac1414aa00000000000000001c00028008000300ffffffff08000200080000000800020002000000b00004802400078008000400fcffffff0800040001000000080003000500000008000400ffffffff3400078008000100100000000800010003000000080001000000000008000200000400000800030087070000080001001a0000005400078008000200020000000800030003000000080001000f00000008000300030000000800040005000000080002000700000008000200b3fcffff080001000a00000008000400b1a2000008000300e30000000c00038008000300080000002c000380080002000700000008000300ff0700000800010001a30000080003000000000008000200040f0000100007800c0004000000000000000000400005803c0002800800030000010000080001001d000000080001000700000008000200030000000800040011060000080001000900000008000300070000004000078008000100982d00000c00040001000000000000000c00040002000000000000000c0003000000000000000000080002000100008008000100030000006b9f7cd9918ca4dfd5770161701b99baea8bed979a6cb74e5e0a04c4aafd7ee4235c1df8dc1a20afd92d2466dc966006edcb8607c8f3da7d6ab836b36640585afc24650e49fe34224dac9330e44a1ad5678d1942f237ddb5874efe1b0e92bff582ab7b12b220ac3ce25cc19bbcb6450efaf44e39647042efad4729e79229782926a26a7176a7f360076a4233e253c2b212a28bfe2d79e616eb4e3deef4264b66c4664177"], 0x284}, 0x1, 0x0, 0x0, 0x40000}, 0x2400c048) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f00000005c0)=0xf02) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES64=r1, @ANYRESDEC=r3, @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x10844}, 0x400c074) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) (async) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="84020008", @ANYRES16=r2, @ANYBLOB="08002bbd04000000000000000000240009800800010009000000080001008000000008000200870e00000800020001000000880001802c0004001400010002004e20e000000200000000000000001400020002004e210000000000000000000000000d0001007564703a73797a31000000000d0001007564703a73797a300000000038000400200001000a004e2000000000ff020000000000000000000000000001000400001400020002004e22ac14142f00000000000000004c0001802c0004001400010002004e24e000000200000000000000001400020002004e20ac1414aa00000000000000001c00028008000300ffffffff08000200080000000800020002000000b00004802400078008000400fcffffff0800040001000000080003000500000008000400ffffffff3400078008000100100000000800010003000000080001000000000008000200000400000800030087070000080001001a0000005400078008000200020000000800030003000000080001000f00000008000300030000000800040005000000080002000700000008000200b3fcffff080001000a00000008000400b1a2000008000300e30000000c00038008000300080000002c000380080002000700000008000300ff0700000800010001a30000080003000000000008000200040f0000100007800c0004000000000000000000400005803c0002800800030000010000080001001d000000080001000700000008000200030000000800040011060000080001000900000008000300070000004000078008000100982d00000c00040001000000000000000c00040002000000000000000c0003000000000000000000080002000100008008000100030000006b9f7cd9918ca4dfd5770161701b99baea8bed979a6cb74e5e0a04c4aafd7ee4235c1df8dc1a20afd92d2466dc966006edcb8607c8f3da7d6ab836b36640585afc24650e49fe34224dac9330e44a1ad5678d1942f237ddb5874efe1b0e92bff582ab7b12b220ac3ce25cc19bbcb6450efaf44e39647042efad4729e79229782926a26a7176a7f360076a4233e253c2b212a28bfe2d79e616eb4e3deef4264b66c4664177"], 0x284}, 0x1, 0x0, 0x0, 0x40000}, 0x2400c048) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) (async) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f00000005c0)=0xf02) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES64=r1, @ANYRESDEC=r3, @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x10844}, 0x400c074) (async) [ 3384.097479] Unknown ioctl 4727 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000100), &(0x7f0000000140)=[0x0], 0x0, 0x8, &(0x7f0000000180)=[{}], 0x8, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000100), &(0x7f0000000140)=[0x0], 0x0, 0x8, &(0x7f0000000180)=[{}], 0x8, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) (async) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) [ 3384.154500] Unknown ioctl 4735 09:00:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000000)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x9b85, 0x40000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) clock_getres(0xfffffffffffffffe, 0x0) pipe(&(0x7f0000000080)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000000)) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0x9b85, 0x40000) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) (async) clock_getres(0xfffffffffffffffe, 0x0) (async) 09:00:57 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x400142, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x1d1003) syz_open_dev$mouse(&(0x7f0000000100), 0xffffffffffffff00, 0x10002) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x1, 0x8e, 0xfffffffd, 0x7f31, 0x0, 0x74}}) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x600000, 0x0) ioctl$KVM_GET_REGS(r5, 0x8090ae81, &(0x7f0000000280)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x4) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) [ 3384.234776] Unknown ioctl 4727 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000100), &(0x7f0000000140)=[0x0], 0x0, 0x8, &(0x7f0000000180)=[{}], 0x8, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="84020008", @ANYRES16=r2, @ANYBLOB="08002bbd04000000000000000000240009800800010009000000080001008000000008000200870e00000800020001000000880001802c0004001400010002004e20e000000200000000000000001400020002004e210000000000000000000000000d0001007564703a73797a31000000000d0001007564703a73797a300000000038000400200001000a004e2000000000ff020000000000000000000000000001000400001400020002004e22ac14142f00000000000000004c0001802c0004001400010002004e24e000000200000000000000001400020002004e20ac1414aa00000000000000001c00028008000300ffffffff08000200080000000800020002000000b00004802400078008000400fcffffff0800040001000000080003000500000008000400ffffffff3400078008000100100000000800010003000000080001000000000008000200000400000800030087070000080001001a0000005400078008000200020000000800030003000000080001000f00000008000300030000000800040005000000080002000700000008000200b3fcffff080001000a00000008000400b1a2000008000300e30000000c00038008000300080000002c000380080002000700000008000300ff0700000800010001a30000080003000000000008000200040f0000100007800c0004000000000000000000400005803c0002800800030000010000080001001d000000080001000700000008000200030000000800040011060000080001000900000008000300070000004000078008000100982d00000c00040001000000000000000c00040002000000000000000c0003000000000000000000080002000100008008000100030000006b9f7cd9918ca4dfd5770161701b99baea8bed979a6cb74e5e0a04c4aafd7ee4235c1df8dc1a20afd92d2466dc966006edcb8607c8f3da7d6ab836b36640585afc24650e49fe34224dac9330e44a1ad5678d1942f237ddb5874efe1b0e92bff582ab7b12b220ac3ce25cc19bbcb6450efaf44e39647042efad4729e79229782926a26a7176a7f360076a4233e253c2b212a28bfe2d79e616eb4e3deef4264b66c4664177"], 0x284}, 0x1, 0x0, 0x0, 0x40000}, 0x2400c048) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f00000005c0)=0xf02) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES64=r1, @ANYRESDEC=r3, @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x10844}, 0x400c074) 09:00:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000000)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x9b85, 0x40000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) clock_getres(0xfffffffffffffffe, 0x0) pipe(&(0x7f0000000080)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000000)) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0x9b85, 0x40000) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) (async) clock_getres(0xfffffffffffffffe, 0x0) (async) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) getpeername$l2tp(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) [ 3384.348033] Unknown ioctl 19456 [ 3384.355004] Unknown ioctl 4727 09:00:57 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x400142, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x1d1003) syz_open_dev$mouse(&(0x7f0000000100), 0xffffffffffffff00, 0x10002) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x1, 0x8e, 0xfffffffd, 0x7f31, 0x0, 0x74}}) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x600000, 0x0) ioctl$KVM_GET_REGS(r5, 0x8090ae81, &(0x7f0000000280)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x4) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x400142, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) (async) syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x1d1003) (async) syz_open_dev$mouse(&(0x7f0000000100), 0xffffffffffffff00, 0x10002) (async) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x1, 0x8e, 0xfffffffd, 0x7f31, 0x0, 0x74}}) (async) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) (async) pipe(&(0x7f0000000ac0)) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x600000, 0x0) (async) ioctl$KVM_GET_REGS(r5, 0x8090ae81, &(0x7f0000000280)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x4) (async) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvmmsg$unix(r1, &(0x7f00000016c0)=[{{&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000200)=""/55, 0x37}, {&(0x7f00000002c0)=""/59, 0x3b}, {&(0x7f0000000300)=""/114, 0x72}, {&(0x7f0000000380)=""/12, 0xc}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/184, 0xb8}, {&(0x7f0000001480)=""/115, 0x73}, {&(0x7f0000001500)=""/211, 0xd3}], 0x8, &(0x7f0000001680)=[@cred={{0x1c}}], 0x20}}], 0x1, 0x4000a000, &(0x7f0000001700)) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r3, @ANYRES64=r2], 0x1c}}, 0x0) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) sendto$unix(r1, &(0x7f0000000040)="6f729187402b62e032b99a7c72a58a7ad9a7b613ae1bb7ad3d88898c4514a30e1eb22451deca30cf6894872d5c41e0b0947d10061dc77ed030079d06fea6fc5728f21b4a69e8ba1ebcef2e4b23", 0x4d, 0x85, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:57 executing program 4: clock_getres(0x0, 0x0) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) getpeername$l2tp(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) getpeername$l2tp(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) (async) 09:00:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvmmsg$unix(r1, &(0x7f00000016c0)=[{{&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000200)=""/55, 0x37}, {&(0x7f00000002c0)=""/59, 0x3b}, {&(0x7f0000000300)=""/114, 0x72}, {&(0x7f0000000380)=""/12, 0xc}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/184, 0xb8}, {&(0x7f0000001480)=""/115, 0x73}, {&(0x7f0000001500)=""/211, 0xd3}], 0x8, &(0x7f0000001680)=[@cred={{0x1c}}], 0x20}}], 0x1, 0x4000a000, &(0x7f0000001700)) (async, rerun: 64) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) (async, rerun: 32) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r3, @ANYRES64=r2], 0x1c}}, 0x0) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) shmdt(0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[], 0x1c}}, 0x0) [ 3384.512937] Unknown ioctl 19456 09:00:57 executing program 4: clock_getres(0x0, 0x0) 09:00:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) getpeername$l2tp(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) getpeername$l2tp(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) (async) 09:00:57 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x400142, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) (async) syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x1d1003) syz_open_dev$mouse(&(0x7f0000000100), 0xffffffffffffff00, 0x10002) (async) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x1, 0x8e, 0xfffffffd, 0x7f31, 0x0, 0x74}}) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x600000, 0x0) (rerun: 64) ioctl$KVM_GET_REGS(r5, 0x8090ae81, &(0x7f0000000280)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x4) 09:00:57 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) sendto$unix(r1, &(0x7f0000000040)="6f729187402b62e032b99a7c72a58a7ad9a7b613ae1bb7ad3d88898c4514a30e1eb22451deca30cf6894872d5c41e0b0947d10061dc77ed030079d06fea6fc5728f21b4a69e8ba1ebcef2e4b23", 0x4d, 0x85, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:57 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) shmdt(0x0) (async, rerun: 32) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[], 0x1c}}, 0x0) (rerun: 32) 09:00:58 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) sendto$unix(r1, &(0x7f0000000040)="6f729187402b62e032b99a7c72a58a7ad9a7b613ae1bb7ad3d88898c4514a30e1eb22451deca30cf6894872d5c41e0b0947d10061dc77ed030079d06fea6fc5728f21b4a69e8ba1ebcef2e4b23", 0x4d, 0x85, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) sendto$unix(r1, &(0x7f0000000040)="6f729187402b62e032b99a7c72a58a7ad9a7b613ae1bb7ad3d88898c4514a30e1eb22451deca30cf6894872d5c41e0b0947d10061dc77ed030079d06fea6fc5728f21b4a69e8ba1ebcef2e4b23", 0x4d, 0x85, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) 09:00:58 executing program 4: clock_getres(0x0, 0x0) clock_getres(0x0, 0x0) (async) [ 3384.684165] Unknown ioctl 19456 09:00:58 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x3}, 0x8) 09:00:58 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYRESDEC=r1], 0x1c}}, 0x8000) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) recvmmsg$unix(r1, &(0x7f00000016c0)=[{{&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000200)=""/55, 0x37}, {&(0x7f00000002c0)=""/59, 0x3b}, {&(0x7f0000000300)=""/114, 0x72}, {&(0x7f0000000380)=""/12, 0xc}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/184, 0xb8}, {&(0x7f0000001480)=""/115, 0x73}, {&(0x7f0000001500)=""/211, 0xd3}], 0x8, &(0x7f0000001680)=[@cred={{0x1c}}], 0x20}}], 0x1, 0x4000a000, &(0x7f0000001700)) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r3, @ANYRES64=r2], 0x1c}}, 0x0) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) shmdt(0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[], 0x1c}}, 0x0) 09:00:58 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYRESDEC=r1], 0x1c}}, 0x8000) 09:00:58 executing program 4: clock_getres(0x6, 0x0) 09:00:58 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x3}, 0x8) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x3}, 0x8) (async) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r1) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, r3, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c5}, 0x800) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r4, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r7 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r5, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r7}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r6, 0x7014) r8 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r6) sendmsg$FOU_CMD_ADD(r6, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r8, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r8, 0x301, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x1c}, 0x1, 0x0, 0x0, 0x28c4}, 0x24004884) r9 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:58 executing program 4: clock_getres(0x6, 0x0) clock_getres(0x6, 0x0) (async) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x9) 09:00:58 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x60a00, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x80, 0x101000) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) 09:00:58 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x3}, 0x8) 09:00:58 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 32) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYRESDEC=r1], 0x1c}}, 0x8000) 09:00:58 executing program 4: clock_getres(0x6, 0x0) clock_getres(0x6, 0x0) (async) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r1) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, r3, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c5}, 0x800) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r4, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) (async) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r7 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r5, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r7}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r6, 0x7014) r8 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r6) sendmsg$FOU_CMD_ADD(r6, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r8, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r8, 0x301, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x1c}, 0x1, 0x0, 0x0, 0x28c4}, 0x24004884) (async) r9 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x9) 09:00:58 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x161, 0x201) 09:00:58 executing program 3: clock_gettime(0x2, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1ca6ff8b", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:58 executing program 4: clock_getres(0xfffffffffffffffe, 0x0) syz_open_dev$rtc(&(0x7f0000000000), 0x8001, 0x40000) 09:00:58 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x60a00, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x80, 0x101000) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) (async) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x9) 09:00:58 executing program 3: clock_gettime(0x2, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1ca6ff8b", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r1) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, r3, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c5}, 0x800) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r4, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) pipe(&(0x7f0000000200)={0xffffffffffffffff}) (async) r7 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r5, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r7}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async) ioctl$RTC_VL_CLR(r6, 0x7014) r8 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r6) sendmsg$FOU_CMD_ADD(r6, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r8, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r8, 0x301, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x1c}, 0x1, 0x0, 0x0, 0x28c4}, 0x24004884) (async) r9 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:58 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x60a00, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x80, 0x101000) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) 09:00:58 executing program 4: clock_getres(0xfffffffffffffffe, 0x0) syz_open_dev$rtc(&(0x7f0000000000), 0x8001, 0x40000) clock_getres(0xfffffffffffffffe, 0x0) (async) syz_open_dev$rtc(&(0x7f0000000000), 0x8001, 0x40000) (async) 09:00:58 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async, rerun: 32) syz_open_dev$loop(&(0x7f0000000040), 0x161, 0x201) (rerun: 32) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000039d8db211ec2157ccc5d1e6703d3ac4c2a420247bd968d7551f6c2b03016484aba4505076ecc13da54e5fe9f554fe5a9b525ccc18f5c4125818aca5d8f4dd984d9ee61aa2135bc4e05145da4fdd50876d142c4ab5ef272c916b8e5b52237c9a6f86226d13de948c89b6322dacb9ad24de195357f11e17bcbea86", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x402480, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000080)) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000039d8db211ec2157ccc5d1e6703d3ac4c2a420247bd968d7551f6c2b03016484aba4505076ecc13da54e5fe9f554fe5a9b525ccc18f5c4125818aca5d8f4dd984d9ee61aa2135bc4e05145da4fdd50876d142c4ab5ef272c916b8e5b52237c9a6f86226d13de948c89b6322dacb9ad24de195357f11e17bcbea86", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x402480, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000080)) 09:00:58 executing program 4: clock_getres(0xfffffffffffffffe, 0x0) (async) syz_open_dev$rtc(&(0x7f0000000000), 0x8001, 0x40000) 09:00:58 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x161, 0x201) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_open_dev$loop(&(0x7f0000000040), 0x161, 0x201) (async) 09:00:58 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x11400, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r1) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="65f34c64", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x8050) 09:00:58 executing program 3: clock_gettime(0x2, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1ca6ff8b", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000039d8db211ec2157ccc5d1e6703d3ac4c2a420247bd968d7551f6c2b03016484aba4505076ecc13da54e5fe9f554fe5a9b525ccc18f5c4125818aca5d8f4dd984d9ee61aa2135bc4e05145da4fdd50876d142c4ab5ef272c916b8e5b52237c9a6f86226d13de948c89b6322dacb9ad24de195357f11e17bcbea86", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x402480, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000080)) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000039d8db211ec2157ccc5d1e6703d3ac4c2a420247bd968d7551f6c2b03016484aba4505076ecc13da54e5fe9f554fe5a9b525ccc18f5c4125818aca5d8f4dd984d9ee61aa2135bc4e05145da4fdd50876d142c4ab5ef272c916b8e5b52237c9a6f86226d13de948c89b6322dacb9ad24de195357f11e17bcbea86", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x402480, 0x0) (async) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000080)) (async) 09:00:58 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000380)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fbdbdf25030000000c000600020000000000000008000a0026215d270c000400ffff0000000000004400078008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB, @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="07000a002e232d0008000100000000000c00040004000000000000000c0002000600000000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r5, 0x7014) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f00000003c0), 0x88000, 0x0) ioctl$RNDCLEARPOOL(r8, 0x5206, &(0x7f0000000400)=0xc67) sendmsg$FOU_CMD_ADD(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r7, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040804}, 0x850) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x2000, 0x0) ioctl$BLKROSET(r8, 0x125d, &(0x7f0000000480)=0x1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) ioctl$LOOP_SET_FD(r9, 0x4c00, r10) clock_getres(0xfffffffffffffffe, 0x0) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="65f34c64", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x8050) 09:00:58 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x11400, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r1) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x11400, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r1) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) 09:00:58 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000080)={0x7, 0x1, 0x0, [{0xfd, 0x8001, 0x8, 0x3f, 0x8, 0x20, 0x81, '\x00', 0x4}]}) 09:00:58 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) 09:00:58 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0, @ANYBLOB="a25d5f2ccfe4999e660980f05c9c06fa", @ANYBLOB="fbf7fffffffffffffc2004"], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x4048001) 09:00:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="65f34c64", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x8050) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="65f34c64", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x8050) (async) 09:00:59 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x11400, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r1) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:59 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000380)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) (async, rerun: 64) pipe(&(0x7f0000000200)={0xffffffffffffffff}) (async, rerun: 64) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fbdbdf25030000000c000600020000000000000008000a0026215d270c000400ffff0000000000004400078008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB, @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="07000a002e232d0008000100000000000c00040004000000000000000c0002000600000000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async) ioctl$RTC_VL_CLR(r5, 0x7014) (async) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f00000003c0), 0x88000, 0x0) ioctl$RNDCLEARPOOL(r8, 0x5206, &(0x7f0000000400)=0xc67) (async) sendmsg$FOU_CMD_ADD(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r7, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040804}, 0x850) (async) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x2000, 0x0) (async, rerun: 64) ioctl$BLKROSET(r8, 0x125d, &(0x7f0000000480)=0x1) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) ioctl$LOOP_SET_FD(r9, 0x4c00, r10) clock_getres(0xfffffffffffffffe, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0, @ANYBLOB="a25d5f2ccfe4999e660980f05c9c06fa", @ANYBLOB="fbf7fffffffffffffc2004"], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x4048001) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0, @ANYBLOB="a25d5f2ccfe4999e660980f05c9c06fa", @ANYBLOB="fbf7fffffffffffffc2004"], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x4048001) (async) [ 3385.672857] Unknown ioctl 20998 [ 3385.676819] Unknown ioctl 4701 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) 09:00:59 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000080)={0x7, 0x1, 0x0, [{0xfd, 0x8001, 0x8, 0x3f, 0x8, 0x20, 0x81, '\x00', 0x4}]}) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$RTC_UIE_ON(r2, 0x7003) 09:00:59 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = syz_open_dev$video(&(0x7f0000000080), 0xa000000000000000, 0x20000) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000040)={0x0, {0x100, 0x1}}) 09:00:59 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000080)={0x7, 0x1, 0x0, [{0xfd, 0x8001, 0x8, 0x3f, 0x8, 0x20, 0x81, '\x00', 0x4}]}) 09:00:59 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000380)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) (async) pipe(&(0x7f0000000200)={0xffffffffffffffff}) (async) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fbdbdf25030000000c000600020000000000000008000a0026215d270c000400ffff0000000000004400078008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB, @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="07000a002e232d0008000100000000000c00040004000000000000000c0002000600000000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async) ioctl$RTC_VL_CLR(r5, 0x7014) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f00000003c0), 0x88000, 0x0) ioctl$RNDCLEARPOOL(r8, 0x5206, &(0x7f0000000400)=0xc67) (async) sendmsg$FOU_CMD_ADD(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r7, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040804}, 0x850) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x2000, 0x0) (async) ioctl$BLKROSET(r8, 0x125d, &(0x7f0000000480)=0x1) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) (async) ioctl$LOOP_SET_FD(r9, 0x4c00, r10) (async) clock_getres(0xfffffffffffffffe, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0, @ANYBLOB="a25d5f2ccfe4999e660980f05c9c06fa", @ANYBLOB="fbf7fffffffffffffc2004"], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x4048001) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0, @ANYBLOB="a25d5f2ccfe4999e660980f05c9c06fa", @ANYBLOB="fbf7fffffffffffffc2004"], 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x4048001) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$RTC_UIE_ON(r2, 0x7003) 09:00:59 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = syz_open_dev$video(&(0x7f0000000080), 0xa000000000000000, 0x20000) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000040)={0x0, {0x100, 0x1}}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) syz_open_dev$video(&(0x7f0000000080), 0xa000000000000000, 0x20000) (async) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000040)={0x0, {0x100, 0x1}}) (async) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="b2499b040c28332e3bd200006c9a0b1444e790235a515c51110317cf49556686e39c133b2648c86fd2aea65ce331"], 0x1c}}, 0x20010000) 09:00:59 executing program 4: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x9) clock_getres(0xfffffffffffffffe, 0x0) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$RTC_UIE_ON(r2, 0x7003) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) (async) 09:00:59 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_virt_wifi\x00'}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r0}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="b2499b040c28332e3bd200006c9a0b1444e790235a515c51110317cf49556686e39c133b2648c86fd2aea65ce331"], 0x1c}}, 0x20010000) [ 3385.981076] Unknown ioctl 20998 [ 3385.985514] Unknown ioctl 4701 09:00:59 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = syz_open_dev$video(&(0x7f0000000080), 0xa000000000000000, 0x20000) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000040)={0x0, {0x100, 0x1}}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) syz_open_dev$video(&(0x7f0000000080), 0xa000000000000000, 0x20000) (async) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000040)={0x0, {0x100, 0x1}}) (async) 09:00:59 executing program 4: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x9) (async) clock_getres(0xfffffffffffffffe, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="b2499b040c28332e3bd200006c9a0b1444e790235a515c51110317cf49556686e39c133b2648c86fd2aea65ce331"], 0x1c}}, 0x20010000) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="b2499b040c28332e3bd200006c9a0b1444e790235a515c51110317cf49556686e39c133b2648c86fd2aea65ce331"], 0x1c}}, 0x20010000) (async) 09:00:59 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_virt_wifi\x00'}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r0}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_virt_wifi\x00'}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r0}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r2) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:59 executing program 5: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0x80000001, 0x1d1581) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c040000", @ANYRES16=r1, @ANYRESOCT=r0], 0x1c}}, 0x0) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r2) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:59 executing program 4: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x9) clock_getres(0xfffffffffffffffe, 0x0) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = syz_open_dev$rtc(&(0x7f0000000000), 0x3, 0x214000) ioctl$RTC_VL_CLR(r2, 0x7014) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0x80000001, 0x1d1581) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c040000", @ANYRES16=r1, @ANYRESOCT=r0], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0x80000001, 0x1d1581) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r3) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c040000", @ANYRES16=r1, @ANYRESOCT=r0], 0x1c}}, 0x0) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r2) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:59 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_virt_wifi\x00'}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r0}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_virt_wifi\x00'}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r0}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) 09:00:59 executing program 5: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) setresuid(0x0, 0x0, 0x0) (async) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="e271cb3a", @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf25150000008c000180080003000600000044000400200001000a004e20fffffff7fe80000000000000000000000000001901800000200002000a004e2200000040fe8000000000000000000008000000bb0000000008000300ffffffff0c000280080003007b0000000d0001007564703a73797a300000000008000300010000000d000164703a73797a310000000034000780dcbe7eca01f8ffff080001000000010008000200060000000c00030005000000000000000c000300d8070000000000001c0002801400038008000200010000800800020002000000040004006c000680080001000700000004000500080006007f0000004500040067636d28616573290000000000000000000000000000000000000000000000001d0000000e13b8863b2942a846acd6b074b697bda37e3ef407f6568bc87fa16fee000000040005000400050004000500400005801c0002800800030005000000080001001c00000008000400030000000800010065746800080001006574680008000100756470000800010065746800380007800c00030049feffffffffffff0c000300e0ffffffffffffff080002004f0c000008000200080000000c0003000100010000000000"], 0x1d4}, 0x1, 0x0, 0x0, 0x24004010}, 0x80) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, r3, 0x3130c29956d18d0f, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0xfe}}]}, 0x30}}, 0x0) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = syz_open_dev$rtc(&(0x7f0000000000), 0x3, 0x214000) ioctl$RTC_VL_CLR(r2, 0x7014) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) syz_open_dev$rtc(&(0x7f0000000000), 0x3, 0x214000) (async) ioctl$RTC_VL_CLR(r2, 0x7014) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="e271cb3a", @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf25150000008c000180080003000600000044000400200001000a004e20fffffff7fe80000000000000000000000000001901800000200002000a004e2200000040fe8000000000000000000008000000bb0000000008000300ffffffff0c000280080003007b0000000d0001007564703a73797a300000000008000300010000000d000164703a73797a310000000034000780dcbe7eca01f8ffff080001000000010008000200060000000c00030005000000000000000c000300d8070000000000001c0002801400038008000200010000800800020002000000040004006c000680080001000700000004000500080006007f0000004500040067636d28616573290000000000000000000000000000000000000000000000001d0000000e13b8863b2942a846acd6b074b697bda37e3ef407f6568bc87fa16fee000000040005000400050004000500400005801c0002800800030005000000080001001c00000008000400030000000800010065746800080001006574680008000100756470000800010065746800380007800c00030049feffffffffffff0c000300e0ffffffffffffff080002004f0c000008000200080000000c0003000100010000000000"], 0x1d4}, 0x1, 0x0, 0x0, 0x24004010}, 0x80) (async, rerun: 32) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (rerun: 32) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, r3, 0x3130c29956d18d0f, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0xfe}}]}, 0x30}}, 0x0) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0x80000001, 0x1d1581) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c040000", @ANYRES16=r1, @ANYRESOCT=r0], 0x1c}}, 0x0) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="e271cb3a", @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf25150000008c000180080003000600000044000400200001000a004e20fffffff7fe80000000000000000000000000001901800000200002000a004e2200000040fe8000000000000000000008000000bb0000000008000300ffffffff0c000280080003007b0000000d0001007564703a73797a300000000008000300010000000d000164703a73797a310000000034000780dcbe7eca01f8ffff080001000000010008000200060000000c00030005000000000000000c000300d8070000000000001c0002801400038008000200010000800800020002000000040004006c000680080001000700000004000500080006007f0000004500040067636d28616573290000000000000000000000000000000000000000000000001d0000000e13b8863b2942a846acd6b074b697bda37e3ef407f6568bc87fa16fee000000040005000400050004000500400005801c0002800800030005000000080001001c00000008000400030000000800010065746800080001006574680008000100756470000800010065746800380007800c00030049feffffffffffff0c000300e0ffffffffffffff080002004f0c000008000200080000000c0003000100010000000000"], 0x1d4}, 0x1, 0x0, 0x0, 0x24004010}, 0x80) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, r3, 0x3130c29956d18d0f, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0xfe}}]}, 0x30}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="e271cb3a", @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf25150000008c000180080003000600000044000400200001000a004e20fffffff7fe80000000000000000000000000001901800000200002000a004e2200000040fe8000000000000000000008000000bb0000000008000300ffffffff0c000280080003007b0000000d0001007564703a73797a300000000008000300010000000d000164703a73797a310000000034000780dcbe7eca01f8ffff080001000000010008000200060000000c00030005000000000000000c000300d8070000000000001c0002801400038008000200010000800800020002000000040004006c000680080001000700000004000500080006007f0000004500040067636d28616573290000000000000000000000000000000000000000000000001d0000000e13b8863b2942a846acd6b074b697bda37e3ef407f6568bc87fa16fee000000040005000400050004000500400005801c0002800800030005000000080001001c00000008000400030000000800010065746800080001006574680008000100756470000800010065746800380007800c00030049feffffffffffff0c000300e0ffffffffffffff080002004f0c000008000200080000000c0003000100010000000000"], 0x1d4}, 0x1, 0x0, 0x0, 0x24004010}, 0x80) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, r3, 0x3130c29956d18d0f, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0xfe}}]}, 0x30}}, 0x0) (async) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:59 executing program 5: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) (async) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r3) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = syz_open_dev$rtc(&(0x7f0000000000), 0x3, 0x214000) ioctl$RTC_VL_CLR(r2, 0x7014) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) syz_open_dev$rtc(&(0x7f0000000000), 0x3, 0x214000) (async) ioctl$RTC_VL_CLR(r2, 0x7014) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x10}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xc3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:59 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r1) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x4, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20004800}, 0x4008809) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000300)) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r5) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r4, 0x101}, 0x14}}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x128, r4, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x400}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xa4aa}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xd15}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe29f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x200}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x40}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xce7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffff}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x28fd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fffffff}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x8004) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r1) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x10}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xc3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:59 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r3) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) (async) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r3) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:00:59 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x4, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20004800}, 0x4008809) (async) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000300)) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r5) (async) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r4, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x128, r4, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x400}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xa4aa}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xd15}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe29f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x200}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x40}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xce7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffff}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x28fd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fffffff}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x8004) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c00000097d40e48151da1bf385c3c113ebe172d3acbde2505c191d3558da5910fd9456706991077cf8c08bf0c78496d5d78e7121d2876bbb07ef99103c45b1105e65625379d5e161a64e091d5dd06d00dc20f0978f3e8bde007ec8bf01d62a57400bac4197bfcf4", @ANYRES16=r1, @ANYBLOB="fbffffffffff0000de1f04"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x809940c0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x90) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x10}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xc3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c00000097d40e48151da1bf385c3c113ebe172d3acbde2505c191d3558da5910fd9456706991077cf8c08bf0c78496d5d78e7121d2876bbb07ef99103c45b1105e65625379d5e161a64e091d5dd06d00dc20f0978f3e8bde007ec8bf01d62a57400bac4197bfcf4", @ANYRES16=r1, @ANYBLOB="fbffffffffff0000de1f04"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x809940c0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x90) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="fcffffff25a92ea61cb777a54986c59c5bd01f4c8f3d3fe6d80d61da31b92683cb4a9e963f81a3d03b47f690863a5370ab37b3bb1298414faa6b55480ffe8d298c98a93121f00e327d9d0d496b206088a142cced7f37bd98f505d77e0e0c7a6db99b10aef72fa73bf2af3ca659da", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) 09:00:59 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r3) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) (async) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r3) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}]}, 0x64}}, 0x801) 09:00:59 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) (async) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c00000097d40e48151da1bf385c3c113ebe172d3acbde2505c191d3558da5910fd9456706991077cf8c08bf0c78496d5d78e7121d2876bbb07ef99103c45b1105e65625379d5e161a64e091d5dd06d00dc20f0978f3e8bde007ec8bf01d62a57400bac4197bfcf4", @ANYRES16=r1, @ANYBLOB="fbffffffffff0000de1f04"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x809940c0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x90) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="fcffffff25a92ea61cb777a54986c59c5bd01f4c8f3d3fe6d80d61da31b92683cb4a9e963f81a3d03b47f690863a5370ab37b3bb1298414faa6b55480ffe8d298c98a93121f00e327d9d0d496b206088a142cced7f37bd98f505d77e0e0c7a6db99b10aef72fa73bf2af3ca659da", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x4, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20004800}, 0x4008809) (async) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000300)) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r5) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r4, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x128, r4, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x400}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xa4aa}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xd15}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe29f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x200}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x40}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xce7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffff}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x28fd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fffffff}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x8004) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="fcffffff25a92ea61cb777a54986c59c5bd01f4c8f3d3fe6d80d61da31b92683cb4a9e963f81a3d03b47f690863a5370ab37b3bb1298414faa6b55480ffe8d298c98a93121f00e327d9d0d496b206088a142cced7f37bd98f505d77e0e0c7a6db99b10aef72fa73bf2af3ca659da", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="fcffffff25a92ea61cb777a54986c59c5bd01f4c8f3d3fe6d80d61da31b92683cb4a9e963f81a3d03b47f690863a5370ab37b3bb1298414faa6b55480ffe8d298c98a93121f00e327d9d0d496b206088a142cced7f37bd98f505d77e0e0c7a6db99b10aef72fa73bf2af3ca659da", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000040)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) (async) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0x0, 0x0) 09:00:59 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x12600, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x84800, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000f5eb450f75ac214232f86123daceba4878f4", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048800}, 0x20000000) 09:00:59 executing program 1: ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3f, 0x0) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000f5eb450f75ac214232f86123daceba4878f4", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NFC_CMD_GET_SE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x14}}, 0x8) shmget(0x3, 0x3000, 0x1840, &(0x7f0000ffc000/0x3000)=nil) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r0, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000004c0)={'tunl0\x00', &(0x7f0000000440)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x2, {{0xc, 0x4, 0x0, 0x8, 0x30, 0x67, 0x0, 0x0, 0x2f, 0x0, @local, @private=0xa010102, {[@ssrr={0x89, 0x13, 0x53, [@dev={0xac, 0x14, 0x14, 0x2b}, @dev={0xac, 0x14, 0x14, 0x1c}, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @generic={0x89, 0x9, "0ef76193fe87cc"}]}}}}}) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r6, 0x101}, 0x14}}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xb8, r6, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x30}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048800}, 0x20000000) 09:00:59 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048800}, 0x20000000) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048800}, 0x20000000) (async) 09:00:59 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000f5eb450f75ac214232f86123daceba4878f4", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000f5eb450f75ac214232f86123daceba4878f4", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) 09:00:59 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NFC_CMD_GET_SE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x14}}, 0x8) shmget(0x3, 0x3000, 0x1840, &(0x7f0000ffc000/0x3000)=nil) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r0, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000004c0)={'tunl0\x00', &(0x7f0000000440)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x2, {{0xc, 0x4, 0x0, 0x8, 0x30, 0x67, 0x0, 0x0, 0x2f, 0x0, @local, @private=0xa010102, {[@ssrr={0x89, 0x13, 0x53, [@dev={0xac, 0x14, 0x14, 0x2b}, @dev={0xac, 0x14, 0x14, 0x1c}, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @generic={0x89, 0x9, "0ef76193fe87cc"}]}}}}}) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r6, 0x101}, 0x14}}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xb8, r6, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x30}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NFC_CMD_GET_SE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x14}}, 0x8) (async) shmget(0x3, 0x3000, 0x1840, &(0x7f0000ffc000/0x3000)=nil) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r0, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000004c0)={'tunl0\x00', &(0x7f0000000440)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x2, {{0xc, 0x4, 0x0, 0x8, 0x30, 0x67, 0x0, 0x0, 0x2f, 0x0, @local, @private=0xa010102, {[@ssrr={0x89, 0x13, 0x53, [@dev={0xac, 0x14, 0x14, 0x2b}, @dev={0xac, 0x14, 0x14, 0x1c}, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @generic={0x89, 0x9, "0ef76193fe87cc"}]}}}}}) (async) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r6, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xb8, r6, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x30}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) (async) 09:00:59 executing program 1: ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3f, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3f, 0x0) (async) 09:00:59 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x12600, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x84800, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x12600, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x84800, 0x0) (async) 09:00:59 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="3b42a3dbdcd93c3745f26cf50aa3b8488bccfbcae52fd5ff99975559930f1540794e9ffb163fffffffffffffff7fd116890042583a2e2b5cf50c690395011a89b764ca894166b0a704223ef3fa", @ANYRES8=r3, @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 09:01:00 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="3b42a3dbdcd93c3745f26cf50aa3b8488bccfbcae52fd5ff99975559930f1540794e9ffb163fffffffffffffff7fd116890042583a2e2b5cf50c690395011a89b764ca894166b0a704223ef3fa", @ANYRES8=r3, @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NFC_CMD_GET_SE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x14}}, 0x8) (async) shmget(0x3, 0x3000, 0x1840, &(0x7f0000ffc000/0x3000)=nil) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r0, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000004c0)={'tunl0\x00', &(0x7f0000000440)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x2, {{0xc, 0x4, 0x0, 0x8, 0x30, 0x67, 0x0, 0x0, 0x2f, 0x0, @local, @private=0xa010102, {[@ssrr={0x89, 0x13, 0x53, [@dev={0xac, 0x14, 0x14, 0x2b}, @dev={0xac, 0x14, 0x14, 0x1c}, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @generic={0x89, 0x9, "0ef76193fe87cc"}]}}}}}) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r6, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xb8, r6, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x30}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) 09:01:00 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x12600, 0x0) (async) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x84800, 0x0) 09:01:00 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 1: ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3f, 0x0) 09:01:00 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000080), 0x4, 0x12d00) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f00000000c0)={[0x100000, 0xf000, 0x4000, 0x110002], 0xc2d1, 0xec, 0x396}) ioctl$NBD_SET_SIZE_BLOCKS(r2, 0xab07, 0x355) syz_open_dev$mouse(&(0x7f0000000040), 0x81, 0x40002) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_0\x00'}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x20}}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x20040000) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="140081d51ef0ee9d3280400a00b60cc2f20fb7da4a41098f7994ef273ad8668fb676f4680b1ee735e977575bd622d02abda043a034de1395e1d7044de166a0a62d4d0160646c20881743b64cbc8ef05d63750adf3e0db3564c01ff6eeceae902fc940ea655d6af096d1bb620c1ab1ac9a58e3e5fd583aa448bbabd0c4198044d5034f235fdaee0b6e0e1ab2d69162e3decf69a2ae8e6a1057a9b5f01163adb", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) ioctl$BLKIOOPT(r4, 0x1279, &(0x7f00000001c0)) 09:01:00 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = syz_open_dev$mouse(&(0x7f0000000080), 0x4, 0x12d00) (async) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f00000000c0)={[0x100000, 0xf000, 0x4000, 0x110002], 0xc2d1, 0xec, 0x396}) ioctl$NBD_SET_SIZE_BLOCKS(r2, 0xab07, 0x355) syz_open_dev$mouse(&(0x7f0000000040), 0x81, 0x40002) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:00 executing program 3: ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000080)) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fb6eb8f20cc00aac040c04"], 0x1c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)={0x134, r3, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xf8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x49}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ed}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x40004}, 0x24008080) 09:01:00 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="3b42a3dbdcd93c3745f26cf50aa3b8488bccfbcae52fd5ff99975559930f1540794e9ffb163fffffffffffffff7fd116890042583a2e2b5cf50c690395011a89b764ca894166b0a704223ef3fa", @ANYRES8=r3, @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="3b42a3dbdcd93c3745f26cf50aa3b8488bccfbcae52fd5ff99975559930f1540794e9ffb163fffffffffffffff7fd116890042583a2e2b5cf50c690395011a89b764ca894166b0a704223ef3fa", @ANYRES8=r3, @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async, rerun: 32) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_0\x00'}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x20}}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x20040000) (async, rerun: 32) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="140081d51ef0ee9d3280400a00b60cc2f20fb7da4a41098f7994ef273ad8668fb676f4680b1ee735e977575bd622d02abda043a034de1395e1d7044de166a0a62d4d0160646c20881743b64cbc8ef05d63750adf3e0db3564c01ff6eeceae902fc940ea655d6af096d1bb620c1ab1ac9a58e3e5fd583aa448bbabd0c4198044d5034f235fdaee0b6e0e1ab2d69162e3decf69a2ae8e6a1057a9b5f01163adb", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async, rerun: 64) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) (rerun: 64) ioctl$BLKIOOPT(r4, 0x1279, &(0x7f00000001c0)) 09:01:00 executing program 3: ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000080)) (async) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fb6eb8f20cc00aac040c04"], 0x1c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)={0x134, r3, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xf8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x49}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ed}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x40004}, 0x24008080) 09:01:00 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000080), 0x4, 0x12d00) (async) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f00000000c0)={[0x100000, 0xf000, 0x4000, 0x110002], 0xc2d1, 0xec, 0x396}) (async, rerun: 32) ioctl$NBD_SET_SIZE_BLOCKS(r2, 0xab07, 0x355) (rerun: 32) syz_open_dev$mouse(&(0x7f0000000040), 0x81, 0x40002) (async, rerun: 32) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (rerun: 32) 09:01:00 executing program 4: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000340)={0xffffffffffffffff}) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x1a4, 0x0, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x8c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x72, 0x3, "d30c5744e8360a806b86b1145831d049983d85658185aacc29c41e8df4f645c6a2e6ce00496b9e90259217fc754b30e72ea27f522cdfed51e08d162776fb781f89c3b733aa7972d8a37196177893acf3a6478e7e50748e01b261ed86c2fb355e6fbc3df4b84a20f7e33e91c41028"}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x33}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}]}, @TIPC_NLA_SOCK={0xa4, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5fc}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x20}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8e09}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7cc7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x57b}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3ff}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000080)={0x9ed4}, 0x4) r3 = syz_open_dev$mouse(&(0x7f0000000040), 0x7fffffff, 0x0) ioctl$RTC_VL_CLR(r3, 0x7014) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000300)=0x50007) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r6) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000000b80)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000ac0)={0x68, r7, 0x800, 0x70bd2b, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r9) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000600)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r11) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000640)={0x7c, r7, 0x408, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x108}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8000000000000001}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3f}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r9}, {0x8, 0x1, r11}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000080) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_0\x00'}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x20}}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x20040000) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="140081d51ef0ee9d3280400a00b60cc2f20fb7da4a41098f7994ef273ad8668fb676f4680b1ee735e977575bd622d02abda043a034de1395e1d7044de166a0a62d4d0160646c20881743b64cbc8ef05d63750adf3e0db3564c01ff6eeceae902fc940ea655d6af096d1bb620c1ab1ac9a58e3e5fd583aa448bbabd0c4198044d5034f235fdaee0b6e0e1ab2d69162e3decf69a2ae8e6a1057a9b5f01163adb", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) ioctl$BLKIOOPT(r4, 0x1279, &(0x7f00000001c0)) 09:01:00 executing program 3: ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000080)) (async) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fb6eb8f20cc00aac040c04"], 0x1c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)={0x134, r3, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xf8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x49}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ed}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x40004}, 0x24008080) 09:01:00 executing program 4: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, 0x0, 0x1ff) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000340)={0xffffffffffffffff}) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x1a4, 0x0, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x8c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x72, 0x3, "d30c5744e8360a806b86b1145831d049983d85658185aacc29c41e8df4f645c6a2e6ce00496b9e90259217fc754b30e72ea27f522cdfed51e08d162776fb781f89c3b733aa7972d8a37196177893acf3a6478e7e50748e01b261ed86c2fb355e6fbc3df4b84a20f7e33e91c41028"}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x33}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}]}, @TIPC_NLA_SOCK={0xa4, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5fc}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x20}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8e09}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7cc7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x57b}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3ff}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async, rerun: 32) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000080)={0x9ed4}, 0x4) (async, rerun: 32) r3 = syz_open_dev$mouse(&(0x7f0000000040), 0x7fffffff, 0x0) ioctl$RTC_VL_CLR(r3, 0x7014) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000300)=0x50007) (async, rerun: 32) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (rerun: 32) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r6) (async) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000000b80)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000ac0)={0x68, r7, 0x800, 0x70bd2b, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) (async, rerun: 32) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r9) (async) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000600)) (async, rerun: 32) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r11) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000640)={0x7c, r7, 0x408, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x108}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8000000000000001}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3f}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r9}, {0x8, 0x1, r11}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000080) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xff}, @L2TP_ATTR_DEBUG={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20008001) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x2b, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004", @ANYRES64=r0, @ANYRESDEC=r1], 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) 09:01:00 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendto$unix(r0, &(0x7f0000000040)="d57e96844278e0e51bbbce364cea60f13a7369cf00e4aa37c461c487b03e737872372054a7a1c79c485c3927c0dd56922143f6ab3bbffc1e5c10a4c71fd2705ce8e063b0cfcf911bd0ea98058ba1f08af716e3e5ed885eb35e92b93c2b1347c2f5ea2edba5c60d0e0883f763d22172e2b95887a87856ada4c0ba44c8e440a3bd33ae487ae27af53616e0be6ec8d14d2050eef4b2b40a07c08ecdb9459f7ae3cc4d1760ae7a82ea5717dcea70e3550b94d7a5e40890", 0xb5, 0x8000, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 09:01:00 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket(0x3, 0x3, 0xffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x9c5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8000}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7ff}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000084}, 0x80) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:00 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendto$unix(r0, &(0x7f0000000040)="d57e96844278e0e51bbbce364cea60f13a7369cf00e4aa37c461c487b03e737872372054a7a1c79c485c3927c0dd56922143f6ab3bbffc1e5c10a4c71fd2705ce8e063b0cfcf911bd0ea98058ba1f08af716e3e5ed885eb35e92b93c2b1347c2f5ea2edba5c60d0e0883f763d22172e2b95887a87856ada4c0ba44c8e440a3bd33ae487ae27af53616e0be6ec8d14d2050eef4b2b40a07c08ecdb9459f7ae3cc4d1760ae7a82ea5717dcea70e3550b94d7a5e40890", 0xb5, 0x8000, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) (async) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 09:01:00 executing program 4: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, 0x0, 0x1ff) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000340)={0xffffffffffffffff}) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x1a4, 0x0, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x8c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x72, 0x3, "d30c5744e8360a806b86b1145831d049983d85658185aacc29c41e8df4f645c6a2e6ce00496b9e90259217fc754b30e72ea27f522cdfed51e08d162776fb781f89c3b733aa7972d8a37196177893acf3a6478e7e50748e01b261ed86c2fb355e6fbc3df4b84a20f7e33e91c41028"}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x33}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}]}, @TIPC_NLA_SOCK={0xa4, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5fc}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x20}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8e09}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7cc7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x57b}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3ff}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async, rerun: 64) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000080)={0x9ed4}, 0x4) (async, rerun: 64) r3 = syz_open_dev$mouse(&(0x7f0000000040), 0x7fffffff, 0x0) ioctl$RTC_VL_CLR(r3, 0x7014) (async) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000300)=0x50007) (async) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r6) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000000b80)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000ac0)={0x68, r7, 0x800, 0x70bd2b, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffff9}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x488c0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r8) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r9) (async, rerun: 32) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000600)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r11) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000640)={0x7c, r7, 0x408, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x108}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8000000000000001}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3f}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r9}, {0x8, 0x1, r11}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000080) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xff}, @L2TP_ATTR_DEBUG={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20008001) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x2b, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004", @ANYRES64=r0, @ANYRESDEC=r1], 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) 09:01:00 executing program 1: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) write$yama_ptrace_scope(r0, 0x0, 0x0) write$yama_ptrace_scope(r0, &(0x7f0000000080)='2\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x1b, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f00000000c0)) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x408800, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket(0x3, 0x3, 0xffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x9c5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8000}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7ff}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000084}, 0x80) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) socket(0x3, 0x3, 0xffff) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x9c5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8000}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7ff}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000084}, 0x80) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) 09:01:00 executing program 4: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, 0x0, 0x1ff) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x4080, 0x0) socket(0x25, 0x1, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:00 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = socket(0x3, 0x3, 0xffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x9c5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8000}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7ff}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000084}, 0x80) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:00 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendto$unix(r0, &(0x7f0000000040)="d57e96844278e0e51bbbce364cea60f13a7369cf00e4aa37c461c487b03e737872372054a7a1c79c485c3927c0dd56922143f6ab3bbffc1e5c10a4c71fd2705ce8e063b0cfcf911bd0ea98058ba1f08af716e3e5ed885eb35e92b93c2b1347c2f5ea2edba5c60d0e0883f763d22172e2b95887a87856ada4c0ba44c8e440a3bd33ae487ae27af53616e0be6ec8d14d2050eef4b2b40a07c08ecdb9459f7ae3cc4d1760ae7a82ea5717dcea70e3550b94d7a5e40890", 0xb5, 0x8000, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) (async) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xff}, @L2TP_ATTR_DEBUG={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20008001) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x2b, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004", @ANYRES64=r0, @ANYRESDEC=r1], 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xff}, @L2TP_ATTR_DEBUG={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20008001) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x2b, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004", @ANYRES64=r0, @ANYRESDEC=r1], 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) (async) 09:01:00 executing program 1: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) write$yama_ptrace_scope(r0, 0x0, 0x0) write$yama_ptrace_scope(r0, &(0x7f0000000080)='2\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x1b, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f00000000c0)) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x408800, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) (async) write$yama_ptrace_scope(r0, 0x0, 0x0) (async) write$yama_ptrace_scope(r0, &(0x7f0000000080)='2\x00', 0x2) (async) syz_open_dev$loop(&(0x7f0000000040), 0x1b, 0x0) (async) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f00000000c0)) (async) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x408800, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x4080, 0x0) socket(0x25, 0x1, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x4080, 0x0) (async) socket(0x25, 0x1, 0x0) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) (async) 09:01:00 executing program 4: getsockname$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x6e) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="9ed9a35397de74ceb19566"], 0x1c}}, 0x0) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff4f0d88cd5d414561"], 0x1c}}, 0x0) 09:01:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x10}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xc3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:00 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), r2) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x4080, 0x0) socket(0x25, 0x1, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:00 executing program 1: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) write$yama_ptrace_scope(r0, 0x0, 0x0) (async, rerun: 32) write$yama_ptrace_scope(r0, &(0x7f0000000080)='2\x00', 0x2) (async, rerun: 32) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x1b, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f00000000c0)) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x408800, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="9ed9a35397de74ceb19566"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="9ed9a35397de74ceb19566"], 0x1c}}, 0x0) (async) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff4f0d88cd5d414561"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff4f0d88cd5d414561"], 0x1c}}, 0x0) (async) 09:01:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff4f0d88cd5d414561"], 0x1c}}, 0x0) 09:01:00 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8201, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000100)=0x7ff) recvfrom$l2tp(r2, &(0x7f0000000180)=""/28, 0x1c, 0x0, &(0x7f00000001c0)={0x2, 0x0, @multicast1}, 0x10) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000140)) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000080)) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24048000}, 0x0) 09:01:00 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000380)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fbdbdf25030000000c000600020000000000000008000a0026215d270c000400ffff0000000000004400078008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB, @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="07000a002e232d0008000100000000000c00040004000000000000000c0002000600000000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r5, 0x7014) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f00000003c0), 0x88000, 0x0) ioctl$RNDCLEARPOOL(r8, 0x5206, &(0x7f0000000400)=0xc67) sendmsg$FOU_CMD_ADD(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r7, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040804}, 0x850) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x2000, 0x0) ioctl$BLKROSET(r8, 0x125d, &(0x7f0000000480)=0x1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) ioctl$LOOP_SET_FD(r9, 0x4c00, r10) clock_getres(0xfffffffffffffffe, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="9ed9a35397de74ceb19566"], 0x1c}}, 0x0) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff4f0d88cd5d414561"], 0x1c}}, 0x0) 09:01:00 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8201, 0x0) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000100)=0x7ff) recvfrom$l2tp(r2, &(0x7f0000000180)=""/28, 0x1c, 0x0, &(0x7f00000001c0)={0x2, 0x0, @multicast1}, 0x10) (async) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000140)) (async) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000080)) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24048000}, 0x0) 09:01:00 executing program 5: clock_gettime(0x2, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1ca6ff8b", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvmmsg$unix(r1, &(0x7f00000016c0)=[{{&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000200)=""/55, 0x37}, {&(0x7f00000002c0)=""/59, 0x3b}, {&(0x7f0000000300)=""/114, 0x72}, {&(0x7f0000000380)=""/12, 0xc}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/184, 0xb8}, {&(0x7f0000001480)=""/115, 0x73}, {&(0x7f0000001500)=""/211, 0xd3}], 0x8, &(0x7f0000001680)=[@cred={{0x1c}}], 0x20}}], 0x1, 0x4000a000, &(0x7f0000001700)) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r3, @ANYRES64=r2], 0x1c}}, 0x0) 09:01:00 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x400142, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x1d1003) syz_open_dev$mouse(&(0x7f0000000100), 0xffffffffffffff00, 0x10002) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x1, 0x8e, 0xfffffffd, 0x7f31, 0x0, 0x74}}) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x600000, 0x0) ioctl$KVM_GET_REGS(r5, 0x8090ae81, &(0x7f0000000280)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x4) [ 3387.351552] Unknown ioctl 20998 [ 3387.368689] Unknown ioctl 4701 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)={0x264, r3, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x124, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x37c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18a0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18b4}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9e85}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6b33}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xcd3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x20}]}, @TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6d0d0f30}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffff800}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK={0x7c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3bc}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x264}}, 0x4004004) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)={0x58, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0xa, 0xa, '\\-]:{,'}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r5}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}]}, 0x58}}, 0xc0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:00 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x400142, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x1d1003) syz_open_dev$mouse(&(0x7f0000000100), 0xffffffffffffff00, 0x10002) syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x1, 0x8e, 0xfffffffd, 0x7f31, 0x0, 0x74}}) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x600000, 0x0) ioctl$KVM_GET_REGS(r5, 0x8090ae81, &(0x7f0000000280)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x4) 09:01:00 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24048000}, 0x0) 09:01:00 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8201, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000100)=0x7ff) recvfrom$l2tp(r2, &(0x7f0000000180)=""/28, 0x1c, 0x0, &(0x7f00000001c0)={0x2, 0x0, @multicast1}, 0x10) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000140)) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8201, 0x0) (async) pipe(&(0x7f00000000c0)) (async) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000100)=0x7ff) (async) recvfrom$l2tp(r2, &(0x7f0000000180)=""/28, 0x1c, 0x0, &(0x7f00000001c0)={0x2, 0x0, @multicast1}, 0x10) (async) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000140)) (async) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000080)) (async) 09:01:00 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)={0x264, r3, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x124, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x37c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18a0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18b4}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9e85}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6b33}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xcd3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x20}]}, @TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6d0d0f30}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffff800}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK={0x7c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3bc}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x264}}, 0x4004004) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)={0x58, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0xa, 0xa, '\\-]:{,'}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r5}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}]}, 0x58}}, 0xc0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) [ 3387.443165] Unknown ioctl 19456 09:01:00 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000240)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvfrom$l2tp(r1, &(0x7f0000000140)=""/207, 0xcf, 0x10000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) 09:01:00 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000240)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvfrom$l2tp(r1, &(0x7f0000000140)=""/207, 0xcf, 0x10000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) 09:01:00 executing program 5: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x80000000401) clock_getres(0xfffffffffffffffe, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SNDCTL_TMR_SELECT(r3, 0x40045408) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) 09:01:00 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) (async) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)={0x264, r3, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x124, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x37c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18a0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18b4}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9e85}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6b33}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xcd3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x20}]}, @TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6d0d0f30}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffff800}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK={0x7c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3bc}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x264}}, 0x4004004) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)={0x58, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0xa, 0xa, '\\-]:{,'}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r5}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}]}, 0x58}}, 0xc0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) [ 3387.513036] Unknown ioctl 19456 09:01:00 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000240)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvfrom$l2tp(r1, &(0x7f0000000140)=""/207, 0xcf, 0x10000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) 09:01:00 executing program 1: ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x2100) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_open_dev$rtc(&(0x7f0000000140), 0x6, 0x8000) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x8) ioctl$RTC_WIE_OFF(r2, 0x7010) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000000c0)={0x28, 0x32, 0x14, 0x10, 0x7, 0xfff, 0x3, 0x1b}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) 09:01:00 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000000)={0x7, 0x80, 0x1}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) (async) 09:01:00 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000011}, 0x40801) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) 09:01:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fbdbdf25030000000c000600020000000000000008000a0026215d270c000800f8ffffffffffffff4400078008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="07000a002e232d0008000100000000000c00040004000000000000000c0002000600000000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r5, 0x7014) r8 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) ioctl$RTC_WIE_OFF(r6, 0x7010) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="020028bd7000fddbdf250100000005000400000000000580040000000000040005000891a9c3345c3ca53590fc7100060000"], 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x6c, r8, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e23}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @dev={0xac, 0x14, 0x14, 0x3c}}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast1}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x62}]}, 0x6c}, 0x1, 0x0, 0x0, 0xe751a69892c031bb}, 0x800) 09:01:00 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x498000) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x8, 0x6}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:00 executing program 1: ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000080)) (async) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x2100) (async) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_open_dev$rtc(&(0x7f0000000140), 0x6, 0x8000) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x8) ioctl$RTC_WIE_OFF(r2, 0x7010) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000000c0)={0x28, 0x32, 0x14, 0x10, 0x7, 0xfff, 0x3, 0x1b}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) 09:01:00 executing program 0: sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x80}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xd54}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '$-&}'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00e8ec5142f67e000329bd7000fddbdf250100000014000900ff020000000000000000000200000001040005020500020008000000050004000200000006000a004e030000"], 0x44}, 0x1, 0x0, 0x0, 0x850}, 0x4004014) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/79, 0x4f}, {&(0x7f0000000140)=""/80, 0x50}, {&(0x7f00000001c0)=""/156, 0x9c}], 0x3, &(0x7f00000002c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}, 0x12080) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f00000003c0)) 09:01:01 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x498000) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x8, 0x6}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:01 executing program 4: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x1cb080, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x6000, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:01 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x498000) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x8, 0x6}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000100)={0x6, 0x0, [{0xaff, 0x0, 0x1000}, {0x331, 0x0, 0x1000000000000000}, {0xb0dcc09fa45a1e59, 0x0, 0x4}, {0x321, 0x0, 0x8000}, {0x88b, 0x0, 0x4d00}, {0x22e, 0x0, 0x1000}]}) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000200", @ANYRES16=r2, @ANYBLOB="010000000000fedbdf2507000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="ae8fa7fef44c5fa8df250200000005000d0001000000060002000000000008001100010000000c0016000001000000000000050014000400001400040000005238886405ba37bac4507f61ce2489e0062d9bc86482b7b5de80bf5f56f25f46c8ea14fe985ae6c1a3475103b81167c79b75bd4c722f510180000000000000e9556ac84473b44d8ed4109fae2d29c07f9d2b0dfa2d098d7ed4725fcfaf56e5f3dc"], 0x48}, 0x1, 0x0, 0x0, 0x14}, 0x4004004) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) r6 = socket(0x1f, 0x6, 0x40) recvmsg$unix(r6, &(0x7f0000000480)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/73, 0x49}], 0x1, &(0x7f0000000380)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x2000) ioctl$BLKFLSBUF(r4, 0x1261, 0xfffffffffffffffc) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="0100010065746c62002b667265656572202d6e65745f7072696f202d637075736574202d6465767963657320"], 0x2d) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$LOOP_CTL_ADD(r7, 0x4c80, 0x1) r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r8, 0x4c82) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000011}, 0x40801) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000011}, 0x40801) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1cc9ab631ae1b6ff3f4be9720000a8", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x200}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xf4f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40040) 09:01:01 executing program 1: ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000080)) (async) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x2100) (async) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) r3 = syz_open_dev$rtc(&(0x7f0000000140), 0x6, 0x8000) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x8) (async) ioctl$RTC_WIE_OFF(r2, 0x7010) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000000c0)={0x28, 0x32, 0x14, 0x10, 0x7, 0xfff, 0x3, 0x1b}) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) 09:01:01 executing program 0: sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x80}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xd54}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '$-&}'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00e8ec5142f67e000329bd7000fddbdf250100000014000900ff020000000000000000000200000001040005020500020008000000050004000200000006000a004e030000"], 0x44}, 0x1, 0x0, 0x0, 0x850}, 0x4004014) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/79, 0x4f}, {&(0x7f0000000140)=""/80, 0x50}, {&(0x7f00000001c0)=""/156, 0x9c}], 0x3, &(0x7f00000002c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}, 0x12080) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f00000003c0)) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1cc9ab631ae1b6ff3f4be9720000a8", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x200}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xf4f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40040) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000011}, 0x40801) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 0: sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x80}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xd54}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '$-&}'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00e8ec5142f67e000329bd7000fddbdf250100000014000900ff020000000000000000000200000001040005020500020008000000050004000200000006000a004e030000"], 0x44}, 0x1, 0x0, 0x0, 0x850}, 0x4004014) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/79, 0x4f}, {&(0x7f0000000140)=""/80, 0x50}, {&(0x7f00000001c0)=""/156, 0x9c}], 0x3, &(0x7f00000002c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}, 0x12080) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f00000003c0)) 09:01:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000100)={0x6, 0x0, [{0xaff, 0x0, 0x1000}, {0x331, 0x0, 0x1000000000000000}, {0xb0dcc09fa45a1e59, 0x0, 0x4}, {0x321, 0x0, 0x8000}, {0x88b, 0x0, 0x4d00}, {0x22e, 0x0, 0x1000}]}) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000200", @ANYRES16=r2, @ANYBLOB="010000000000fedbdf2507000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="ae8fa7fef44c5fa8df250200000005000d0001000000060002000000000008001100010000000c0016000001000000000000050014000400001400040000005238886405ba37bac4507f61ce2489e0062d9bc86482b7b5de80bf5f56f25f46c8ea14fe985ae6c1a3475103b81167c79b75bd4c722f510180000000000000e9556ac84473b44d8ed4109fae2d29c07f9d2b0dfa2d098d7ed4725fcfaf56e5f3dc"], 0x48}, 0x1, 0x0, 0x0, 0x14}, 0x4004004) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) r6 = socket(0x1f, 0x6, 0x40) recvmsg$unix(r6, &(0x7f0000000480)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/73, 0x49}], 0x1, &(0x7f0000000380)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x2000) ioctl$BLKFLSBUF(r4, 0x1261, 0xfffffffffffffffc) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="0100010065746c62002b667265656572202d6e65745f7072696f202d637075736574202d6465767963657320"], 0x2d) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$LOOP_CTL_ADD(r7, 0x4c80, 0x1) r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r8, 0x4c82) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1cc9ab631ae1b6ff3f4be9720000a8", @ANYRES16=r1, @ANYBLOB="01000000000000000000030000000500020002000000"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x200}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xf4f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40040) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) getsockname$unix(r0, &(0x7f0000000100), &(0x7f00000000c0)=0x5839) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r1) 09:01:01 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) getuid() r3 = getuid() r4 = getuid() setresuid(r3, r4, 0xee00) setresuid(r1, r2, r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) getuid() r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$inet_icmp_raw(0x2, 0x3, 0x1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) getuid() syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r7) r8 = syz_open_dev$media(&(0x7f0000000c40), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc0287c02, &(0x7f00000000c0)={0x80000000, &(0x7f0000000000)=[{}, {0x80000000}], 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc0287c02, &(0x7f00000002c0)={r9, 0x0, 0x0}) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x0, 0x10, 0x70bd2d, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40004840}, 0x20000800) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc0287c02, &(0x7f00000001c0)={r9, &(0x7f0000000100), &(0x7f0000000140)}) sendmsg$L2TP_CMD_TUNNEL_DELETE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000b0", @ANYRES16=r6, @ANYBLOB="fbffffffffffff1153200c"], 0x1c}}, 0x0) r10 = getuid() getresuid(&(0x7f0000000f00)=0x0, &(0x7f0000000f40), &(0x7f0000000f80)) r12 = getuid() r13 = getuid() setresuid(r12, r13, 0xee00) setresuid(r10, r11, r13) recvmmsg$unix(r7, &(0x7f0000000d80)=[{{&(0x7f00000003c0)=@abs, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000440)=""/22, 0x16}, {&(0x7f0000000480)=""/64, 0x40}, {&(0x7f00000004c0)=""/1, 0x1}, {&(0x7f0000000500)=""/123, 0x7b}, {&(0x7f0000000580)=""/243, 0xf3}], 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000001100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x78}}, {{&(0x7f0000000780), 0x6e, &(0x7f0000000c80)=[{&(0x7f0000000800)=""/22, 0x16}, {&(0x7f0000000840)=""/13, 0xd}, {&(0x7f0000000880)=""/193, 0xc1}, {&(0x7f0000000980)=""/187, 0xbb}, {&(0x7f0000000a40)=""/18, 0x12}, {&(0x7f0000000b00)=""/213, 0xd5}], 0x6, &(0x7f0000000d00)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}], 0x2, 0x40000000, &(0x7f0000000c00)) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000ec0)={r9, &(0x7f0000000e00), &(0x7f0000000e40)}) 09:01:01 executing program 0: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000040)) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x88, r1, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xed}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x814) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000100)={0x6, 0x0, [{0xaff, 0x0, 0x1000}, {0x331, 0x0, 0x1000000000000000}, {0xb0dcc09fa45a1e59, 0x0, 0x4}, {0x321, 0x0, 0x8000}, {0x88b, 0x0, 0x4d00}, {0x22e, 0x0, 0x1000}]}) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000200", @ANYRES16=r2, @ANYBLOB="010000000000fedbdf2507000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="ae8fa7fef44c5fa8df250200000005000d0001000000060002000000000008001100010000000c0016000001000000000000050014000400001400040000005238886405ba37bac4507f61ce2489e0062d9bc86482b7b5de80bf5f56f25f46c8ea14fe985ae6c1a3475103b81167c79b75bd4c722f510180000000000000e9556ac84473b44d8ed4109fae2d29c07f9d2b0dfa2d098d7ed4725fcfaf56e5f3dc"], 0x48}, 0x1, 0x0, 0x0, 0x14}, 0x4004004) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) r6 = socket(0x1f, 0x6, 0x40) recvmsg$unix(r6, &(0x7f0000000480)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/73, 0x49}], 0x1, &(0x7f0000000380)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x2000) ioctl$BLKFLSBUF(r4, 0x1261, 0xfffffffffffffffc) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="0100010065746c62002b667265656572202d6e65745f7072696f202d637075736574202d6465767963657320"], 0x2d) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$LOOP_CTL_ADD(r7, 0x4c80, 0x1) r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r8, 0x4c82) 09:01:01 executing program 0: ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f0000000000)) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0xa8020, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:01 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) getsockname$unix(r0, &(0x7f0000000100), &(0x7f00000000c0)=0x5839) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r1) socket$unix(0x1, 0x5, 0x0) (async) getsockname$unix(r0, &(0x7f0000000100), &(0x7f00000000c0)=0x5839) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r1) (async) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000180)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xa00000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0xb4, r3, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc0000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffc00}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x73}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3f}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x48000}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 2: r0 = socket$unix(0x1, 0x5, 0x0) getsockname$unix(r0, &(0x7f0000000100), &(0x7f00000000c0)=0x5839) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r1) 09:01:01 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) getsockname$unix(r0, &(0x7f0000000100), &(0x7f00000000c0)=0x5839) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r1) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000180)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xa00000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0xb4, r3, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc0000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffc00}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x73}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3f}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x48000}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 4: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc040564b, &(0x7f0000000040)={0x9, 0x0, 0x1013, 0x7, 0x1, {0x3, 0xdc5}}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000140)=0x200) getpeername$unix(0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000200)=0x6e) r4 = socket(0x3, 0x5, 0x2) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="010000ec8f000000000007000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="2881acf3", @ANYRES16=r6, @ANYBLOB="20002abd7000fbdbdf250800000005000d000100000006001c002000000006001c00ff0f00000c000f0001000000010000000500220000000000"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x4000) clock_getres(0xfffffffffffffffe, 0x0) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_TMR_METRONOME(r7, 0x40045407) ioctl$NBD_SET_FLAGS(r2, 0xab0a, 0xffffffff) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f0000000100)={0x0, 0x0, r0}) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000200)) r5 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r5, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) [ 3387.961710] Unknown ioctl 19586 09:01:01 executing program 1: recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003ac0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000002680)=[{&(0x7f0000000100)=""/195, 0xc3}, {&(0x7f0000000000)=""/60, 0x3c}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/255, 0xff}, {&(0x7f0000001300)=""/184, 0xb8}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000023c0)=""/183, 0xb7}, {&(0x7f0000002480)=""/244, 0xf4}, {&(0x7f0000002580)=""/152, 0x98}, {&(0x7f0000002640)=""/37, 0x25}], 0xa}}, {{&(0x7f0000002740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000027c0)=""/254, 0xfe}, {&(0x7f00000028c0)=""/3, 0x3}, {&(0x7f0000002900)=""/179, 0xb3}, {&(0x7f00000029c0)=""/4096, 0x1000}], 0x4, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}], 0x2, 0xc0000040, &(0x7f0000003b40)) syz_open_dev$loop(&(0x7f0000000040), 0x13b, 0x0) 09:01:01 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) getuid() r2 = getuid() setresuid(0xee01, r0, r2) clock_getres(0xfffffffffffffffe, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000000), 0x100000000, 0x440100) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) recvmsg$unix(r3, &(0x7f0000001440)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/157, 0x9d}, {&(0x7f0000000180)=""/42, 0x2a}, {&(0x7f00000001c0)}, {&(0x7f0000000200)=""/85, 0x55}, {&(0x7f0000000280)=""/74, 0x4a}, {&(0x7f0000000300)=""/4096, 0x1000}], 0x6, &(0x7f0000001480)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r4, @ANYRES32, @ANYRES32, @ANYBLOB="0246e8d9db63a2002300a5ca7bc40000502cf8e8c16cee29d8cebb3ff919dcfd05d99b60788cd1826166502d9be4eaed40d3ed081adc7699ebc696e6266eb9bb04b5cef8f12908b13efb737323cab1a874cf6a92096f306e3c7e6747841554d33f592ad5398b687070e19b384e4972e8ef4ac817ddaa107c585b410e04e9c0ff5487f03a56e952bc63ba3aa1c23268e8274d19cda36ac1074f25fe0b2646fa7dc3f52135edecf3f736cb07ab9b4619ab25f5a51c518c39b69bca39cc66d2cc11ca8cf76b454bd6a728afc142532177460f5e5e6dbee04d4cbcc398e0b2acb0412abae796e1147896aea7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0xc0}, 0x40000002) clock_getres(0x5, &(0x7f00000001c0)) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, r1, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x38}}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xffffffffffffffff}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xc9}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x4800) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x74, 0x0, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_PEER_V4={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x33}}, @FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @FOU_ATTR_PEER_V6={0x14, 0x9, @dev={0xfe, 0x80, '\x00', 0x30}}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x33}, @FOU_ATTR_PEER_V4={0x8, 0x8, @remote}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x32}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x40001) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000200)) r5 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r5, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000180)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xa00000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0xb4, r3, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc0000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffc00}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x73}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3f}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x48000}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000180)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) (async) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xa00000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0xb4, r3, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc0000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffc00}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x73}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3f}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x48000}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) 09:01:01 executing program 1: recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003ac0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000002680)=[{&(0x7f0000000100)=""/195, 0xc3}, {&(0x7f0000000000)=""/60, 0x3c}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/255, 0xff}, {&(0x7f0000001300)=""/184, 0xb8}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000023c0)=""/183, 0xb7}, {&(0x7f0000002480)=""/244, 0xf4}, {&(0x7f0000002580)=""/152, 0x98}, {&(0x7f0000002640)=""/37, 0x25}], 0xa}}, {{&(0x7f0000002740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000027c0)=""/254, 0xfe}, {&(0x7f00000028c0)=""/3, 0x3}, {&(0x7f0000002900)=""/179, 0xb3}, {&(0x7f00000029c0)=""/4096, 0x1000}], 0x4, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}], 0x2, 0xc0000040, &(0x7f0000003b40)) syz_open_dev$loop(&(0x7f0000000040), 0x13b, 0x0) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="1cf3d868e1b8d055fa49df0000007710d7f6a619f2b72c65d36ffa081d92a3728d2571e650caacd85ba144302b8f25e94bf70a4f4e5fe23d053f62c21b6d65edbea5a5c192227384b907e24e7e90d009b59339379305d41d9abb606721d56653bb78a5908fe1eb25b0c7d3b39bc3954c694fc3505359f89edd5520b5bb00"/135, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff00201d"], 0x1c}}, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f00000002c0)={0x400, {0x3f, 0x2, 0x9, 0xf4b, 0xb41, 0xbd2}}) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)={0x224, r2, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x64, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3adcf103}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x10001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x80, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x62c}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x20}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK={0xb8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffff18}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xb55f}]}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffff000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x100}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x20}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x40}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xce7a8f68}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x35}]}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x224}, 0x1, 0x0, 0x0, 0x48844}, 0x4000001) 09:01:01 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000000)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$unix(0x1, 0x5, 0x0) getpeername$unix(r2, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000002c0)={0x0, 0x1, 0x0, &(0x7f0000000080)=[{}], 0x1, 0x0, &(0x7f0000000100)=[{}], 0x6, 0x0, &(0x7f0000000180)=[{0x0, 0x80000000}, {}, {}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000240)=[{}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000a00)={0x0, 0x0, 0x0, &(0x7f0000000340), 0x4, 0x0, &(0x7f0000000600)=[{}, {}, {}, {}], 0x5, 0x0, &(0x7f00000007c0)=[{0x0, 0x80000000}, {}, {}, {}, {}], 0x0, 0x0, &(0x7f0000000880)}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f00000009c0)={{r3, 0x0, 0x5, [0x7, 0x7502]}, {r4, 0x0, 0x3, [0x5, 0x9]}, 0x0, [0x7, 0x3ff]}) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) pipe(&(0x7f0000000ac0)) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r4, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r5, 0x7014) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x78, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @remote}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_PEER_V6={0x14, 0x9, @mcast1}, @FOU_ATTR_PEER_V4={0x8, 0x8, @rand_addr=0x64010100}, @FOU_ATTR_PEER_V4={0x8, 0x8, @remote}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private2}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x84}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x8044) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000200)) r5 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r5, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 1: recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003ac0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000002680)=[{&(0x7f0000000100)=""/195, 0xc3}, {&(0x7f0000000000)=""/60, 0x3c}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/255, 0xff}, {&(0x7f0000001300)=""/184, 0xb8}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000023c0)=""/183, 0xb7}, {&(0x7f0000002480)=""/244, 0xf4}, {&(0x7f0000002580)=""/152, 0x98}, {&(0x7f0000002640)=""/37, 0x25}], 0xa}}, {{&(0x7f0000002740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000027c0)=""/254, 0xfe}, {&(0x7f00000028c0)=""/3, 0x3}, {&(0x7f0000002900)=""/179, 0xb3}, {&(0x7f00000029c0)=""/4096, 0x1000}], 0x4, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}], 0x2, 0xc0000040, &(0x7f0000003b40)) syz_open_dev$loop(&(0x7f0000000040), 0x13b, 0x0) 09:01:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[], 0x1c}}, 0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000040)) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 1: ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000080), 0x3c76, 0x101000) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x3e4, r1, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x38}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast1}}}}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x64, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x100, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x32bc7f3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x198}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @private=0xa010102}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xa3, @loopback, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @private1, 0x3}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34a3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA={0x104, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x871}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xb) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (fail_nth: 1) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$inet_udplite(0x2, 0x2, 0x88) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:01 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, 0xee01, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000200)) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, 0xee01, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) getuid() (async) setresuid(r0, 0xee01, r1) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000200)) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 1: ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000080), 0x3c76, 0x101000) ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000000)) (async) syz_open_dev$loop(&(0x7f0000000080), 0x3c76, 0x101000) (async) 09:01:01 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xb) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:01 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, 0xee01, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) getuid() (async) setresuid(r0, 0xee01, r1) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:01 executing program 5: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000200)) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0xfc, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x800}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x8c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd6f4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xe02}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x28}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xb15}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x800) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES8=r3, @ANYBLOB="dffd7fffffffffff002004"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff}) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, 0x0, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x84}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x37}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010101}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44004000}, 0x4040014) inotify_init() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x4000810) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}}, 0x4c840) 09:01:01 executing program 1: ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000080), 0x3c76, 0x101000) 09:01:01 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xb) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0xfc, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x800}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x8c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd6f4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xe02}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x28}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xb15}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x800) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES8=r3, @ANYBLOB="dffd7fffffffffff002004"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) r5 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r5, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff}) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, 0x0, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x84}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x37}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010101}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44004000}, 0x4040014) inotify_init() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x4000810) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}}, 0x4c840) setresuid(0x0, 0xee01, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000000)) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) (async) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, 0x0, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x84}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x37}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010101}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44004000}, 0x4040014) (async) inotify_init() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x4000810) (async) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}}, 0x4c840) (async) 09:01:01 executing program 1: ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000000)=0x3) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) 09:01:01 executing program 5: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0xfc, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x800}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x8c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd6f4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xe02}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x28}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xb15}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x800) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES8=r3, @ANYBLOB="dffd7fffffffffff002004"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 09:01:01 executing program 5: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff}) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, 0x0, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x84}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x37}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010101}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44004000}, 0x4040014) (async) inotify_init() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x4000810) (async) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}}, 0x4c840) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0xfc, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x800}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x8c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xd6f4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xe02}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x28}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xb15}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x800) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES8=r3, @ANYBLOB="dffd7fffffffffff002004"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) pipe(&(0x7f0000000ac0)) r4 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r4, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r1, 0x221}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r1, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r1, 0x221}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r1, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r1, 0x221}, 0x14}}, 0x0) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r1, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:01 executing program 1: ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000000)=0x3) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000000)=0x3) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) (async) 09:01:01 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r1, 0x221}, 0x14}}, 0x0) (async, rerun: 32) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r1, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) (rerun: 32) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:01 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (fail_nth: 1) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESOCT=r1], 0x1c}}, 0x24000084) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) (async) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESOCT=r1], 0x1c}}, 0x24000084) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) r4 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r4, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:01 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:01 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000140)) 09:01:01 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESOCT=r1], 0x1c}}, 0x24000084) 09:01:02 executing program 1: ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000000)=0x3) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000000)=0x3) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) (async) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) [ 3388.699499] FAULT_INJECTION: forcing a failure. [ 3388.699499] name failslab, interval 1, probability 0, space 0, times 0 [ 3388.711341] CPU: 1 PID: 20861 Comm: syz-executor.4 Not tainted 4.14.302-syzkaller #0 [ 3388.719216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3388.728576] Call Trace: [ 3388.731141] dump_stack+0x1b2/0x281 [ 3388.734749] should_fail.cold+0x10a/0x149 [ 3388.738878] should_failslab+0xd6/0x130 [ 3388.742831] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3388.747482] ? dev_uevent_filter+0xd0/0xd0 [ 3388.751702] kobject_uevent_env+0x20c/0xf30 [ 3388.756006] ? wait_for_completion_io+0x10/0x10 [ 3388.760742] ? is_acpi_device_node+0x5b/0x70 [ 3388.765136] device_del+0x642/0xa80 [ 3388.768757] ? __device_links_no_driver+0x1b0/0x1b0 [ 3388.773752] device_unregister+0x22/0xc0 [ 3388.777789] bdi_unregister+0x42f/0x610 [ 3388.781737] ? wb_blkcg_offline+0x180/0x180 [ 3388.786041] del_gendisk+0x453/0x820 [ 3388.789737] ? disk_events_poll_msecs_store+0x150/0x150 [ 3388.795080] ? _raw_spin_unlock_irq+0x5a/0x80 [ 3388.799566] ? blk_cleanup_queue+0x43c/0x620 [ 3388.803949] loop_control_ioctl+0x347/0x3f0 [ 3388.808248] ? loop_lookup+0x190/0x190 [ 3388.812112] ? SyS_write+0x1b7/0x210 [ 3388.815806] ? loop_lookup+0x190/0x190 [ 3388.819676] do_vfs_ioctl+0x75a/0xff0 [ 3388.823451] ? lock_acquire+0x170/0x3f0 [ 3388.827401] ? ioctl_preallocate+0x1a0/0x1a0 [ 3388.831814] ? __fget+0x265/0x3e0 [ 3388.835253] ? do_vfs_ioctl+0xff0/0xff0 [ 3388.839213] ? security_file_ioctl+0x83/0xb0 [ 3388.843603] SyS_ioctl+0x7f/0xb0 [ 3388.846950] ? do_vfs_ioctl+0xff0/0xff0 [ 3388.850917] do_syscall_64+0x1d5/0x640 [ 3388.854795] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3388.859963] RIP: 0033:0x7fc3e9ade0c9 [ 3388.863654] RSP: 002b:00007fc3e8050168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3388.871423] RAX: ffffffffffffffda RBX: 00007fc3e9bfdf80 RCX: 00007fc3e9ade0c9 [ 3388.878687] RDX: 0000000000000000 RSI: 0000000000004c81 RDI: 0000000000000003 [ 3388.885936] RBP: 00007fc3e80501d0 R08: 0000000000000000 R09: 0000000000000000 [ 3388.893183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 09:01:02 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (fail_nth: 2) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x51f}, 0x8) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) [ 3388.900436] R13: 00007ffd4b00232f R14: 00007fc3e8050300 R15: 0000000000022000 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f00000000c0)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x51f}, 0x8) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) (async) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x51f}, 0x8) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) (async) 09:01:02 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) (async) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x51f}, 0x8) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:02 executing program 1: r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r0, @ANYBLOB="000327bd7000fedbdf25010000000c0005000a000000000000000c000800010000000000000008000100000000003c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="2c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="ccde3a4f01438953a0c7a3524e08000180d82fa5fe098ad659c3162ca1eb38b9db01df10c46b05eeb6a92e25bd5ba9650cc1c28df828135a51f7aa292b65b93cf1fb58e95edf85e3876c66e7fdffffffb96f714d3a3d6326a75135ca5ebdc07874f2c26d7b3688d7517ae2678b9660b13a25f7be599089d294aaace879945e81b5e4732f66164439ea471e552543e22136dc06f6d9fc4d1c176dc98e9ad340256a00a3c02cfdc0d2fe33ef6821948c1dd39abe4fcf791b5ebe22eea771fd037f6d976e6f47d22fca2f856da784bbdc2391789116311018bd1fe773d929f71a3fae0ee702fc8657d014b57bfdb19b72421bd87d31128be2cad0f9f3ffb4e09daf3288ad48495a426aa30018c3fb84a6b191d60f46774788ae1044fac6ea60a61a54463552c6c3a023ba82d21a3736872e595ac66ca329ffe02721783196bf6f0750df30e6236c14bc6cea2eb043c94aab84d1d640dbd45d19dc7b7d352cb50a73610d29e0b7f86460b40693", @ANYRES32, @ANYBLOB="0c00030040000000000000000c00030009000000000000000c0004000700000000000000"], 0xc0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f00000000c0)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:02 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x26, 0x800, 0x9) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000040)=@mmap={0x1000, 0x5, 0x4, 0x1000, 0x81, {0x77359400}, {0x3, 0xc, 0x3f, 0xd, 0x7f, 0x8, "98bdbbd2"}, 0x8, 0x1, {}, 0x772}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) 09:01:02 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000000)={0x2c, 0x25, 0x8, 0x1b, 0x5, 0x8000, 0x2, 0xf4, 0x1}) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000000)={0x2c, 0x25, 0x8, 0x1b, 0x5, 0x8000, 0x2, 0xf4, 0x1}) 09:01:02 executing program 1: r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r0, @ANYBLOB="000327bd7000fedbdf25010000000c0005000a000000000000000c000800010000000000000008000100000000003c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="2c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="ccde3a4f01438953a0c7a3524e08000180d82fa5fe098ad659c3162ca1eb38b9db01df10c46b05eeb6a92e25bd5ba9650cc1c28df828135a51f7aa292b65b93cf1fb58e95edf85e3876c66e7fdffffffb96f714d3a3d6326a75135ca5ebdc07874f2c26d7b3688d7517ae2678b9660b13a25f7be599089d294aaace879945e81b5e4732f66164439ea471e552543e22136dc06f6d9fc4d1c176dc98e9ad340256a00a3c02cfdc0d2fe33ef6821948c1dd39abe4fcf791b5ebe22eea771fd037f6d976e6f47d22fca2f856da784bbdc2391789116311018bd1fe773d929f71a3fae0ee702fc8657d014b57bfdb19b72421bd87d31128be2cad0f9f3ffb4e09daf3288ad48495a426aa30018c3fb84a6b191d60f46774788ae1044fac6ea60a61a54463552c6c3a023ba82d21a3736872e595ac66ca329ffe02721783196bf6f0750df30e6236c14bc6cea2eb043c94aab84d1d640dbd45d19dc7b7d352cb50a73610d29e0b7f86460b40693", @ANYRES32, @ANYBLOB="0c00030040000000000000000c00030009000000000000000c0004000700000000000000"], 0xc0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:02 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff81069fc014fa5bc53c31ab475ac8f4f2f6e6d8316b67f5340837d2b0fc3ae98e72d43c33dd5c600"], 0x1c}}, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000000)={0x2c, 0x25, 0x8, 0x1b, 0x5, 0x8000, 0x2, 0xf4, 0x1}) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f00000000c0)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f00000000c0)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, 0x0, 0x0) 09:01:02 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r1, 0xee01, r3) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000000)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002f80)=[{{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000340)=""/76, 0x4c}, {&(0x7f00000003c0)=""/112, 0x70}, {&(0x7f0000000440)=""/134, 0x86}, {&(0x7f0000000500)=""/186, 0xba}, {&(0x7f00000005c0)=""/8, 0x8}, {&(0x7f0000000600)=""/232, 0xe8}, {&(0x7f0000000700)=""/156, 0x9c}], 0x7, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x110}}, {{&(0x7f0000000980), 0x6e, &(0x7f0000002ec0)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/222, 0xde}, {&(0x7f0000001c00)=""/202, 0xca}, {&(0x7f0000001d00)=""/132, 0x84}, {&(0x7f0000000a00)=""/103, 0x67}, {&(0x7f0000001dc0)=""/4096, 0x1000}, {&(0x7f0000002dc0)=""/130, 0x82}, {&(0x7f0000002e80)=""/25, 0x19}], 0x8, &(0x7f0000002f40)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}], 0x2, 0x40002100, &(0x7f0000003000)={0x0, 0x989680}) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r7) r8 = socket(0x9, 0x800, 0x1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r9) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) r11 = syz_open_dev$rtc(&(0x7f0000000280), 0x9, 0x2000) ioctl$RTC_AIE_OFF(r11, 0x7002) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x78, r4, 0x300, 0x70bd26, 0x4, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8}, {0x8, 0x1, r10}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0x78}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000) 09:01:02 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) (async, rerun: 32) r2 = getuid() (async, rerun: 32) r3 = getuid() setresuid(r2, r3, 0xee00) (async, rerun: 64) setresuid(r1, 0xee01, r3) (async, rerun: 64) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000000)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 64) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002f80)=[{{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000340)=""/76, 0x4c}, {&(0x7f00000003c0)=""/112, 0x70}, {&(0x7f0000000440)=""/134, 0x86}, {&(0x7f0000000500)=""/186, 0xba}, {&(0x7f00000005c0)=""/8, 0x8}, {&(0x7f0000000600)=""/232, 0xe8}, {&(0x7f0000000700)=""/156, 0x9c}], 0x7, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x110}}, {{&(0x7f0000000980), 0x6e, &(0x7f0000002ec0)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/222, 0xde}, {&(0x7f0000001c00)=""/202, 0xca}, {&(0x7f0000001d00)=""/132, 0x84}, {&(0x7f0000000a00)=""/103, 0x67}, {&(0x7f0000001dc0)=""/4096, 0x1000}, {&(0x7f0000002dc0)=""/130, 0x82}, {&(0x7f0000002e80)=""/25, 0x19}], 0x8, &(0x7f0000002f40)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}], 0x2, 0x40002100, &(0x7f0000003000)={0x0, 0x989680}) (async, rerun: 64) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) (async) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) pipe(&(0x7f0000000140)={0xffffffffffffffff}) (rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r7) (async) r8 = socket(0x9, 0x800, 0x1) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r9) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) (async) r11 = syz_open_dev$rtc(&(0x7f0000000280), 0x9, 0x2000) ioctl$RTC_AIE_OFF(r11, 0x7002) (async) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x78, r4, 0x300, 0x70bd26, 0x4, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8}, {0x8, 0x1, r10}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0x78}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000) 09:01:02 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x26, 0x800, 0x9) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000040)=@mmap={0x1000, 0x5, 0x4, 0x1000, 0x81, {0x77359400}, {0x3, 0xc, 0x3f, 0xd, 0x7f, 0x8, "98bdbbd2"}, 0x8, 0x1, {}, 0x772}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x26, 0x800, 0x9) (async) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000040)=@mmap={0x1000, 0x5, 0x4, 0x1000, 0x81, {0x77359400}, {0x3, 0xc, 0x3f, 0xd, 0x7f, 0x8, "98bdbbd2"}, 0x8, 0x1, {}, 0x772}) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) (async) 09:01:02 executing program 1: r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r0, @ANYBLOB="000327bd7000fedbdf25010000000c0005000a000000000000000c000800010000000000000008000100000000003c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="2c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="ccde3a4f01438953a0c7a3524e08000180d82fa5fe098ad659c3162ca1eb38b9db01df10c46b05eeb6a92e25bd5ba9650cc1c28df828135a51f7aa292b65b93cf1fb58e95edf85e3876c66e7fdffffffb96f714d3a3d6326a75135ca5ebdc07874f2c26d7b3688d7517ae2678b9660b13a25f7be599089d294aaace879945e81b5e4732f66164439ea471e552543e22136dc06f6d9fc4d1c176dc98e9ad340256a00a3c02cfdc0d2fe33ef6821948c1dd39abe4fcf791b5ebe22eea771fd037f6d976e6f47d22fca2f856da784bbdc2391789116311018bd1fe773d929f71a3fae0ee702fc8657d014b57bfdb19b72421bd87d31128be2cad0f9f3ffb4e09daf3288ad48495a426aa30018c3fb84a6b191d60f46774788ae1044fac6ea60a61a54463552c6c3a023ba82d21a3736872e595ac66ca329ffe02721783196bf6f0750df30e6236c14bc6cea2eb043c94aab84d1d640dbd45d19dc7b7d352cb50a73610d29e0b7f86460b40693", @ANYRES32, @ANYBLOB="0c00030040000000000000000c00030009000000000000000c0004000700000000000000"], 0xc0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, 0x0, 0x0) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r4, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r5, 0x7014) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_TYPE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x48014) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r4, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async, rerun: 32) ioctl$RTC_VL_CLR(r5, 0x7014) (async, rerun: 32) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async, rerun: 64) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_TYPE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x48014) (async, rerun: 64) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:02 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) r2 = getuid() (async) r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r1, 0xee01, r3) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000000)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002f80)=[{{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000340)=""/76, 0x4c}, {&(0x7f00000003c0)=""/112, 0x70}, {&(0x7f0000000440)=""/134, 0x86}, {&(0x7f0000000500)=""/186, 0xba}, {&(0x7f00000005c0)=""/8, 0x8}, {&(0x7f0000000600)=""/232, 0xe8}, {&(0x7f0000000700)=""/156, 0x9c}], 0x7, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x110}}, {{&(0x7f0000000980), 0x6e, &(0x7f0000002ec0)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/222, 0xde}, {&(0x7f0000001c00)=""/202, 0xca}, {&(0x7f0000001d00)=""/132, 0x84}, {&(0x7f0000000a00)=""/103, 0x67}, {&(0x7f0000001dc0)=""/4096, 0x1000}, {&(0x7f0000002dc0)=""/130, 0x82}, {&(0x7f0000002e80)=""/25, 0x19}], 0x8, &(0x7f0000002f40)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}], 0x2, 0x40002100, &(0x7f0000003000)={0x0, 0x989680}) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000140)={0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r7) (async, rerun: 32) r8 = socket(0x9, 0x800, 0x1) (async, rerun: 32) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r9) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r10) (async, rerun: 64) r11 = syz_open_dev$rtc(&(0x7f0000000280), 0x9, 0x2000) (rerun: 64) ioctl$RTC_AIE_OFF(r11, 0x7002) (async, rerun: 32) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x78, r4, 0x300, 0x70bd26, 0x4, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8}, {0x8, 0x1, r10}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0x78}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000) (rerun: 32) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, 0x0, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:02 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000000)) 09:01:02 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x26, 0x800, 0x9) (async) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000040)=@mmap={0x1000, 0x5, 0x4, 0x1000, 0x81, {0x77359400}, {0x3, 0xc, 0x3f, 0xd, 0x7f, 0x8, "98bdbbd2"}, 0x8, 0x1, {}, 0x772}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) pipe(&(0x7f0000000ac0)) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) (async) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r4, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async) ioctl$RTC_VL_CLR(r5, 0x7014) (async) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_TYPE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x48014) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000280)=""/100, 0x64}, {&(0x7f0000000300)=""/84, 0x54}, {&(0x7f0000000380)=""/15, 0xf}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/23, 0x17}, {&(0x7f0000001400)=""/5, 0x5}], 0x6, &(0x7f00000014c0)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000001540)=@abs, 0x6e, &(0x7f0000001ac0)=[{&(0x7f00000015c0)=""/184, 0xb8}, {&(0x7f0000001680)=""/2, 0x2}, {&(0x7f00000016c0)=""/41, 0x29}, {&(0x7f0000001700)=""/233, 0xe9}, {&(0x7f0000001800)=""/161, 0xa1}, {&(0x7f00000018c0)=""/143, 0x8f}, {&(0x7f0000001980)=""/64, 0x40}, {&(0x7f00000019c0)=""/239, 0xef}], 0x8, &(0x7f0000001b40)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000001c00)=@abs, 0x6e, &(0x7f0000001d40)=[{&(0x7f0000001c80)=""/153, 0x99}], 0x1, &(0x7f0000001d80)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f0000001dc0)=""/55, 0x37}, {&(0x7f0000001e00)=""/164, 0xa4}, {&(0x7f0000001ec0)=""/127, 0x7f}, {&(0x7f0000001f40)=""/168, 0xa8}, {&(0x7f0000002000)}, {&(0x7f0000002040)=""/102, 0x66}], 0x6, &(0x7f0000002140)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000002180)=""/249, 0xf9}, {&(0x7f0000002280)=""/39, 0x27}, {&(0x7f00000022c0)=""/1, 0x1}], 0x3, &(0x7f0000002340)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000002380), 0x6e, &(0x7f0000002980)=[{&(0x7f0000002400)=""/198, 0xc6}, {&(0x7f0000002500)=""/132, 0x84}, {&(0x7f00000025c0)=""/243, 0xf3}, {&(0x7f00000026c0)=""/159, 0x9f}, {&(0x7f0000002780)=""/11, 0xb}, {&(0x7f00000027c0)=""/28, 0x1c}, {&(0x7f0000002800)=""/247, 0xf7}, {&(0x7f0000002900)=""/104, 0x68}], 0x8}}, {{&(0x7f0000002a00)=@abs, 0x6e, &(0x7f0000003cc0)=[{&(0x7f0000002a80)=""/4096, 0x1000}, {&(0x7f0000003a80)=""/252, 0xfc}, {&(0x7f0000003b80)=""/57, 0x39}, {&(0x7f0000003bc0)=""/244, 0xf4}], 0x4}}, {{&(0x7f0000003d00)=@abs, 0x6e, &(0x7f0000003e80)=[{&(0x7f0000003d80)=""/211, 0xd3}], 0x1}}], 0x8, 0x2000, &(0x7f00000040c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/130, 0x82}], 0x1}, 0x40000000) 09:01:02 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000000)) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000280)=""/100, 0x64}, {&(0x7f0000000300)=""/84, 0x54}, {&(0x7f0000000380)=""/15, 0xf}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/23, 0x17}, {&(0x7f0000001400)=""/5, 0x5}], 0x6, &(0x7f00000014c0)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000001540)=@abs, 0x6e, &(0x7f0000001ac0)=[{&(0x7f00000015c0)=""/184, 0xb8}, {&(0x7f0000001680)=""/2, 0x2}, {&(0x7f00000016c0)=""/41, 0x29}, {&(0x7f0000001700)=""/233, 0xe9}, {&(0x7f0000001800)=""/161, 0xa1}, {&(0x7f00000018c0)=""/143, 0x8f}, {&(0x7f0000001980)=""/64, 0x40}, {&(0x7f00000019c0)=""/239, 0xef}], 0x8, &(0x7f0000001b40)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000001c00)=@abs, 0x6e, &(0x7f0000001d40)=[{&(0x7f0000001c80)=""/153, 0x99}], 0x1, &(0x7f0000001d80)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f0000001dc0)=""/55, 0x37}, {&(0x7f0000001e00)=""/164, 0xa4}, {&(0x7f0000001ec0)=""/127, 0x7f}, {&(0x7f0000001f40)=""/168, 0xa8}, {&(0x7f0000002000)}, {&(0x7f0000002040)=""/102, 0x66}], 0x6, &(0x7f0000002140)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000002180)=""/249, 0xf9}, {&(0x7f0000002280)=""/39, 0x27}, {&(0x7f00000022c0)=""/1, 0x1}], 0x3, &(0x7f0000002340)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000002380), 0x6e, &(0x7f0000002980)=[{&(0x7f0000002400)=""/198, 0xc6}, {&(0x7f0000002500)=""/132, 0x84}, {&(0x7f00000025c0)=""/243, 0xf3}, {&(0x7f00000026c0)=""/159, 0x9f}, {&(0x7f0000002780)=""/11, 0xb}, {&(0x7f00000027c0)=""/28, 0x1c}, {&(0x7f0000002800)=""/247, 0xf7}, {&(0x7f0000002900)=""/104, 0x68}], 0x8}}, {{&(0x7f0000002a00)=@abs, 0x6e, &(0x7f0000003cc0)=[{&(0x7f0000002a80)=""/4096, 0x1000}, {&(0x7f0000003a80)=""/252, 0xfc}, {&(0x7f0000003b80)=""/57, 0x39}, {&(0x7f0000003bc0)=""/244, 0xf4}], 0x4}}, {{&(0x7f0000003d00)=@abs, 0x6e, &(0x7f0000003e80)=[{&(0x7f0000003d80)=""/211, 0xd3}], 0x1}}], 0x8, 0x2000, &(0x7f00000040c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/130, 0x82}], 0x1}, 0x40000000) 09:01:02 executing program 4: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x2, 0x9) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 09:01:02 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000280)=""/100, 0x64}, {&(0x7f0000000300)=""/84, 0x54}, {&(0x7f0000000380)=""/15, 0xf}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/23, 0x17}, {&(0x7f0000001400)=""/5, 0x5}], 0x6, &(0x7f00000014c0)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000001540)=@abs, 0x6e, &(0x7f0000001ac0)=[{&(0x7f00000015c0)=""/184, 0xb8}, {&(0x7f0000001680)=""/2, 0x2}, {&(0x7f00000016c0)=""/41, 0x29}, {&(0x7f0000001700)=""/233, 0xe9}, {&(0x7f0000001800)=""/161, 0xa1}, {&(0x7f00000018c0)=""/143, 0x8f}, {&(0x7f0000001980)=""/64, 0x40}, {&(0x7f00000019c0)=""/239, 0xef}], 0x8, &(0x7f0000001b40)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000001c00)=@abs, 0x6e, &(0x7f0000001d40)=[{&(0x7f0000001c80)=""/153, 0x99}], 0x1, &(0x7f0000001d80)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f0000001dc0)=""/55, 0x37}, {&(0x7f0000001e00)=""/164, 0xa4}, {&(0x7f0000001ec0)=""/127, 0x7f}, {&(0x7f0000001f40)=""/168, 0xa8}, {&(0x7f0000002000)}, {&(0x7f0000002040)=""/102, 0x66}], 0x6, &(0x7f0000002140)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000002180)=""/249, 0xf9}, {&(0x7f0000002280)=""/39, 0x27}, {&(0x7f00000022c0)=""/1, 0x1}], 0x3, &(0x7f0000002340)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000002380), 0x6e, &(0x7f0000002980)=[{&(0x7f0000002400)=""/198, 0xc6}, {&(0x7f0000002500)=""/132, 0x84}, {&(0x7f00000025c0)=""/243, 0xf3}, {&(0x7f00000026c0)=""/159, 0x9f}, {&(0x7f0000002780)=""/11, 0xb}, {&(0x7f00000027c0)=""/28, 0x1c}, {&(0x7f0000002800)=""/247, 0xf7}, {&(0x7f0000002900)=""/104, 0x68}], 0x8}}, {{&(0x7f0000002a00)=@abs, 0x6e, &(0x7f0000003cc0)=[{&(0x7f0000002a80)=""/4096, 0x1000}, {&(0x7f0000003a80)=""/252, 0xfc}, {&(0x7f0000003b80)=""/57, 0x39}, {&(0x7f0000003bc0)=""/244, 0xf4}], 0x4}}, {{&(0x7f0000003d00)=@abs, 0x6e, &(0x7f0000003e80)=[{&(0x7f0000003d80)=""/211, 0xd3}], 0x1}}], 0x8, 0x2000, &(0x7f00000040c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/130, 0x82}], 0x1}, 0x40000000) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$mouse(&(0x7f0000000080), 0x20, 0x40040) ioctl$RTC_PIE_ON(r2, 0x7005) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c040000000000000050af4919b8da677a78d9ba1ccd9dd42ed2bfd1ca1ae11aa41bf1d1d71f4c00b1c4bb88046666ff1116872f16e9daa38120cfc9026e694f1bfeb2f58900000000d99cd08a6e96f2f848f668", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r5, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r5, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x1) syz_open_dev$mouse(&(0x7f00000000c0), 0xfff, 0x2000) 09:01:02 executing program 4: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x2, 0x9) 09:01:02 executing program 2: r0 = syz_open_dev$rtc(&(0x7f0000000000), 0x3ff, 0x30d02) ioctl$RTC_UIE_OFF(r0, 0x7004) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r1 = syz_open_dev$rtc(&(0x7f0000000080), 0x40, 0x1) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f00000000c0)={0x2b, 0x12, 0x3, 0x1f, 0x6, 0x101, 0x3, 0x92, 0xffffffffffffffff}) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 09:01:02 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000000)) (async) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$mouse(&(0x7f0000000080), 0x20, 0x40040) ioctl$RTC_PIE_ON(r2, 0x7005) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c040000000000000050af4919b8da677a78d9ba1ccd9dd42ed2bfd1ca1ae11aa41bf1d1d71f4c00b1c4bb88046666ff1116872f16e9daa38120cfc9026e694f1bfeb2f58900000000d99cd08a6e96f2f848f668", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r5, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r5, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x1) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0xfff, 0x2000) 09:01:02 executing program 2: r0 = syz_open_dev$rtc(&(0x7f0000000000), 0x3ff, 0x30d02) ioctl$RTC_UIE_OFF(r0, 0x7004) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r1 = syz_open_dev$rtc(&(0x7f0000000080), 0x40, 0x1) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f00000000c0)={0x2b, 0x12, 0x3, 0x1f, 0x6, 0x101, 0x3, 0x92, 0xffffffffffffffff}) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) syz_open_dev$rtc(&(0x7f0000000100), 0x9, 0x8000) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 4: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x2, 0x9) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 09:01:02 executing program 2: r0 = syz_open_dev$rtc(&(0x7f0000000000), 0x3ff, 0x30d02) ioctl$RTC_UIE_OFF(r0, 0x7004) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r1 = syz_open_dev$rtc(&(0x7f0000000080), 0x40, 0x1) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f00000000c0)={0x2b, 0x12, 0x3, 0x1f, 0x6, 0x101, 0x3, 0x92, 0xffffffffffffffff}) syz_open_dev$rtc(&(0x7f0000000000), 0x3ff, 0x30d02) (async) ioctl$RTC_UIE_OFF(r0, 0x7004) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) syz_open_dev$rtc(&(0x7f0000000080), 0x40, 0x1) (async) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f00000000c0)={0x2b, 0x12, 0x3, 0x1f, 0x6, 0x101, 0x3, 0x92, 0xffffffffffffffff}) (async) 09:01:02 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x510300) clock_getres(0x3, &(0x7f0000000000)) 09:01:02 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$mouse(&(0x7f0000000080), 0x20, 0x40040) ioctl$RTC_PIE_ON(r2, 0x7005) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c040000000000000050af4919b8da677a78d9ba1ccd9dd42ed2bfd1ca1ae11aa41bf1d1d71f4c00b1c4bb88046666ff1116872f16e9daa38120cfc9026e694f1bfeb2f58900000000d99cd08a6e96f2f848f668", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r5, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r5, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x1) syz_open_dev$mouse(&(0x7f00000000c0), 0xfff, 0x2000) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_open_dev$mouse(&(0x7f0000000080), 0x20, 0x40040) (async) ioctl$RTC_PIE_ON(r2, 0x7005) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c040000000000000050af4919b8da677a78d9ba1ccd9dd42ed2bfd1ca1ae11aa41bf1d1d71f4c00b1c4bb88046666ff1116872f16e9daa38120cfc9026e694f1bfeb2f58900000000d99cd08a6e96f2f848f668", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r5, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r5, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x1) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0xfff, 0x2000) (async) 09:01:02 executing program 2: ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000080)) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(0x0, 0xee01, r1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:02 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x52000, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:02 executing program 2: ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000080)) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) (async) setresuid(0x0, 0xee01, r1) (async, rerun: 64) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) (rerun: 64) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 09:01:03 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x208100, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000240)={'erspan0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x40, 0x80, 0xfff, 0x7, {{0x7, 0x4, 0x2, 0x1, 0x1c, 0x64, 0x0, 0x3, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x26}, @empty, {[@generic={0x44, 0x6, "c7abc123"}]}}}}}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40807}, 0x24000800) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xc) 09:01:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x1, 0x2, 0x9) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="00042bbd7000fedbdf25080000005d1e4a3f93e7ae93f54b6dff14d18e9862d8ce3a97a87c35dd21bb9b2060797dd4d51e5d16c9200ef50f837db218b0e1bbe060a68588b164cfefe23aa96f8f3b63dac4cc5bf4940a1c69c7fbcc03091308219a3ea52f01d3d8e715f1a3cc1cb2043817e7b9012b0cdf5db71143675345a57cf34d8a"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 09:01:03 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x510300) clock_getres(0x3, &(0x7f0000000000)) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1], 0x1c}}, 0x0) 09:01:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket(0x1, 0x2, 0x9) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="00042bbd7000fedbdf25080000005d1e4a3f93e7ae93f54b6dff14d18e9862d8ce3a97a87c35dd21bb9b2060797dd4d51e5d16c9200ef50f837db218b0e1bbe060a68588b164cfefe23aa96f8f3b63dac4cc5bf4940a1c69c7fbcc03091308219a3ea52f01d3d8e715f1a3cc1cb2043817e7b9012b0cdf5db71143675345a57cf34d8a"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 09:01:03 executing program 2: ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000080)) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(0x0, 0xee01, r1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000080)) (async) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) setresuid(0x0, 0xee01, r1) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:03 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000240)) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x510300) clock_getres(0x3, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x510300) (async) clock_getres(0x3, &(0x7f0000000000)) (async) 09:01:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket(0x1, 0x2, 0x9) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="00042bbd7000fedbdf25080000005d1e4a3f93e7ae93f54b6dff14d18e9862d8ce3a97a87c35dd21bb9b2060797dd4d51e5d16c9200ef50f837db218b0e1bbe060a68588b164cfefe23aa96f8f3b63dac4cc5bf4940a1c69c7fbcc03091308219a3ea52f01d3d8e715f1a3cc1cb2043817e7b9012b0cdf5db71143675345a57cf34d8a"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1], 0x1c}}, 0x0) 09:01:03 executing program 2: ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000000)) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:03 executing program 2: ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000000)) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000000)) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:03 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x208100, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000240)={'erspan0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x40, 0x80, 0xfff, 0x7, {{0x7, 0x4, 0x2, 0x1, 0x1c, 0x64, 0x0, 0x3, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x26}, @empty, {[@generic={0x44, 0x6, "c7abc123"}]}}}}}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40807}, 0x24000800) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xc) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x208100, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000240)={'erspan0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x40, 0x80, 0xfff, 0x7, {{0x7, 0x4, 0x2, 0x1, 0x1c, 0x64, 0x0, 0x3, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x26}, @empty, {[@generic={0x44, 0x6, "c7abc123"}]}}}}}) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40807}, 0x24000800) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xc) (async) 09:01:03 executing program 2: ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000000)) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000000)) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:03 executing program 0: ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000080)={0x2, 0x2, 0x3ff, 0x3, 0x0, 0x0, 0x7ff}) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1], 0x1c}}, 0x0) 09:01:03 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 09:01:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)=""/103, 0x67}, {&(0x7f0000000100)=""/119, 0x77}, {&(0x7f0000000000)=""/5, 0x5}, {&(0x7f0000000180)=""/223, 0xdf}, {&(0x7f0000000280)=""/16, 0x10}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)}], 0x7, &(0x7f0000001500)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="2000000032000000e9f9d81680000019900c53d729a940ed0002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}, 0x40000001) clock_gettime(0x0, &(0x7f00000017c0)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)=""/5, 0x5}], 0x1, &(0x7f00000013c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001400), 0x6e, &(0x7f0000001480)=[{&(0x7f0000001600)=""/206, 0xce}], 0x1, &(0x7f0000001900)=ANY=[@ANYBLOB="2800041cd6c108c1931fac0001000000", @ANYRES32=r0, @ANYRES64=0x0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x28}}], 0x2, 0x20, &(0x7f0000001800)) getresuid(&(0x7f0000001840), &(0x7f0000001880), &(0x7f00000018c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 64) recvmsg$unix(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)=""/103, 0x67}, {&(0x7f0000000100)=""/119, 0x77}, {&(0x7f0000000000)=""/5, 0x5}, {&(0x7f0000000180)=""/223, 0xdf}, {&(0x7f0000000280)=""/16, 0x10}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)}], 0x7, &(0x7f0000001500)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="2000000032000000e9f9d81680000019900c53d729a940ed0002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}, 0x40000001) (rerun: 64) clock_gettime(0x0, &(0x7f00000017c0)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)=""/5, 0x5}], 0x1, &(0x7f00000013c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001400), 0x6e, &(0x7f0000001480)=[{&(0x7f0000001600)=""/206, 0xce}], 0x1, &(0x7f0000001900)=ANY=[@ANYBLOB="2800041cd6c108c1931fac0001000000", @ANYRES32=r0, @ANYRES64=0x0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x28}}], 0x2, 0x20, &(0x7f0000001800)) (async) getresuid(&(0x7f0000001840), &(0x7f0000001880), &(0x7f00000018c0)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:03 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x208100, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000240)={'erspan0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x40, 0x80, 0xfff, 0x7, {{0x7, 0x4, 0x2, 0x1, 0x1c, 0x64, 0x0, 0x3, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x26}, @empty, {[@generic={0x44, 0x6, "c7abc123"}]}}}}}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40807}, 0x24000800) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xc) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x208100, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000240)={'erspan0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x40, 0x80, 0xfff, 0x7, {{0x7, 0x4, 0x2, 0x1, 0x1c, 0x64, 0x0, 0x3, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x26}, @empty, {[@generic={0x44, 0x6, "c7abc123"}]}}}}}) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40807}, 0x24000800) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xc) (async) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)=""/103, 0x67}, {&(0x7f0000000100)=""/119, 0x77}, {&(0x7f0000000000)=""/5, 0x5}, {&(0x7f0000000180)=""/223, 0xdf}, {&(0x7f0000000280)=""/16, 0x10}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)}], 0x7, &(0x7f0000001500)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="2000000032000000e9f9d81680000019900c53d729a940ed0002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}, 0x40000001) clock_gettime(0x0, &(0x7f00000017c0)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)=""/5, 0x5}], 0x1, &(0x7f00000013c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001400), 0x6e, &(0x7f0000001480)=[{&(0x7f0000001600)=""/206, 0xce}], 0x1, &(0x7f0000001900)=ANY=[@ANYBLOB="2800041cd6c108c1931fac0001000000", @ANYRES32=r0, @ANYRES64=0x0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x28}}], 0x2, 0x20, &(0x7f0000001800)) getresuid(&(0x7f0000001840), &(0x7f0000001880), &(0x7f00000018c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)=""/103, 0x67}, {&(0x7f0000000100)=""/119, 0x77}, {&(0x7f0000000000)=""/5, 0x5}, {&(0x7f0000000180)=""/223, 0xdf}, {&(0x7f0000000280)=""/16, 0x10}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)}], 0x7, &(0x7f0000001500)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="2000000032000000e9f9d81680000019900c53d729a940ed0002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}, 0x40000001) (async) clock_gettime(0x0, &(0x7f00000017c0)) (async) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)=""/5, 0x5}], 0x1, &(0x7f00000013c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001400), 0x6e, &(0x7f0000001480)=[{&(0x7f0000001600)=""/206, 0xce}], 0x1, &(0x7f0000001900)=ANY=[@ANYBLOB="2800041cd6c108c1931fac0001000000", @ANYRES32=r0, @ANYRES64=0x0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x28}}], 0x2, 0x20, &(0x7f0000001800)) (async) getresuid(&(0x7f0000001840), &(0x7f0000001880), &(0x7f00000018c0)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:03 executing program 3: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000000)=""/10, 0xa}], 0x1, &(0x7f0000000140)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90}, 0x40) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000000)=""/10, 0xa}], 0x1, &(0x7f0000000140)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90}, 0x40) 09:01:03 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 09:01:03 executing program 3: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000000)=""/10, 0xa}], 0x1, &(0x7f0000000140)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90}, 0x40) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000000)=""/10, 0xa}], 0x1, &(0x7f0000000140)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90}, 0x40) 09:01:03 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x232600, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r1, 0xffffffffffffffff) clock_getres(0x2, &(0x7f00000001c0)) getresuid(&(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) 09:01:03 executing program 0: r0 = syz_open_dev$loop(0x0, 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r1, 0xffffffffffffffff) clock_getres(0x2, &(0x7f00000001c0)) getresuid(&(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) setresuid(0x0, 0xee01, 0x0) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) (async) setresuid(r0, r1, 0xffffffffffffffff) (async) clock_getres(0x2, &(0x7f00000001c0)) (async) getresuid(&(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) (async) 09:01:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4, 0xa, '.#-'}]}, 0x60}}, 0x40810) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r2) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r4, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r5, 0x7014) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r5) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r7, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_TYPE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x48014) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="fbffffffffffffff002004"], 0x1c}}, 0x0) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f95bc1dff6094beb4958365cb0c4eeb7fe1ff810"], 0x1c}}, 0x0) 09:01:03 executing program 0: r0 = syz_open_dev$loop(0x0, 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x232600, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x232600, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:03 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r1, 0xffffffffffffffff) clock_getres(0x2, &(0x7f00000001c0)) getresuid(&(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) setresuid(0x0, 0xee01, 0x0) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) (async) setresuid(r0, r1, 0xffffffffffffffff) (async) clock_getres(0x2, &(0x7f00000001c0)) (async) getresuid(&(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) (async) 09:01:03 executing program 0: r0 = syz_open_dev$loop(0x0, 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, 0x0, 0x0) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:03 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:03 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 1) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:03 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffb, 0x123000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 3390.275667] FAULT_INJECTION: forcing a failure. [ 3390.275667] name failslab, interval 1, probability 0, space 0, times 0 [ 3390.288799] CPU: 1 PID: 21273 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3390.296726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3390.306066] Call Trace: [ 3390.308633] dump_stack+0x1b2/0x281 [ 3390.312251] should_fail.cold+0x10a/0x149 [ 3390.316386] should_failslab+0xd6/0x130 [ 3390.320339] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3390.324989] loop_add+0x83/0x830 [ 3390.328342] ? loop_queue_rq+0x280/0x280 [ 3390.332382] ? loop_queue_work+0x21e0/0x21e0 [ 3390.336777] loop_control_ioctl+0x11a/0x3f0 [ 3390.341076] ? loop_lookup+0x190/0x190 [ 3390.344943] ? SyS_write+0x1b7/0x210 [ 3390.348642] ? loop_lookup+0x190/0x190 [ 3390.352518] do_vfs_ioctl+0x75a/0xff0 [ 3390.356306] ? lock_acquire+0x170/0x3f0 [ 3390.360264] ? ioctl_preallocate+0x1a0/0x1a0 [ 3390.364648] ? __fget+0x265/0x3e0 [ 3390.368087] ? do_vfs_ioctl+0xff0/0xff0 [ 3390.372047] ? security_file_ioctl+0x83/0xb0 [ 3390.376489] SyS_ioctl+0x7f/0xb0 [ 3390.379838] ? do_vfs_ioctl+0xff0/0xff0 [ 3390.383790] do_syscall_64+0x1d5/0x640 [ 3390.388360] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3390.393527] RIP: 0033:0x7f0bff8e60c9 [ 3390.397214] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3390.404906] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3390.412153] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 09:01:03 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x232600, 0x0) (async, rerun: 64) socket(0x0, 0x80000, 0x9) (rerun: 64) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:03 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:03 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 2) 09:01:03 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffb, 0x123000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffb, 0x123000) (async) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) (async) [ 3390.419405] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3390.426648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3390.433982] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000080)={[0xd000, 0x2, 0xf000, 0x10000], 0x7, 0x39, 0x8c46}) 09:01:03 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000080)={[0xd000, 0x2, 0xf000, 0x10000], 0x7, 0x39, 0x8c46}) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000080)={[0xd000, 0x2, 0xf000, 0x10000], 0x7, 0x39, 0x8c46}) (async) [ 3390.511691] FAULT_INJECTION: forcing a failure. [ 3390.511691] name failslab, interval 1, probability 0, space 0, times 0 [ 3390.536843] CPU: 0 PID: 21293 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3390.544740] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3390.554086] Call Trace: [ 3390.556677] dump_stack+0x1b2/0x281 09:01:03 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000080)={[0xd000, 0x2, 0xf000, 0x10000], 0x7, 0x39, 0x8c46}) [ 3390.560308] should_fail.cold+0x10a/0x149 [ 3390.564460] should_failslab+0xd6/0x130 [ 3390.568437] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3390.573541] __kmalloc_node+0x38/0x70 [ 3390.577344] blk_mq_alloc_tag_set+0x27c/0x910 [ 3390.581843] loop_add+0x2a0/0x830 [ 3390.585293] ? loop_queue_rq+0x280/0x280 [ 3390.589349] ? loop_queue_work+0x21e0/0x21e0 [ 3390.593756] loop_control_ioctl+0x11a/0x3f0 [ 3390.598209] ? loop_lookup+0x190/0x190 [ 3390.602264] ? SyS_write+0x1b7/0x210 [ 3390.605973] ? loop_lookup+0x190/0x190 [ 3390.609949] do_vfs_ioctl+0x75a/0xff0 [ 3390.616186] ? lock_acquire+0x170/0x3f0 [ 3390.620158] ? ioctl_preallocate+0x1a0/0x1a0 [ 3390.624570] ? __fget+0x265/0x3e0 [ 3390.628025] ? do_vfs_ioctl+0xff0/0xff0 [ 3390.631994] ? security_file_ioctl+0x83/0xb0 [ 3390.636402] SyS_ioctl+0x7f/0xb0 [ 3390.639771] ? do_vfs_ioctl+0xff0/0xff0 [ 3390.643747] do_syscall_64+0x1d5/0x640 [ 3390.647645] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3390.652831] RIP: 0033:0x7f0bff8e60c9 09:01:04 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) r1 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffb, 0x123000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 3390.656537] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3390.664239] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3390.671506] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3390.678943] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3390.686224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3390.693488] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:04 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:04 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 3) 09:01:04 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe640021f9"], 0x1c}}, 0x0) 09:01:04 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000009c0)={0xc4, 0x0, &(0x7f00000007c0)=[@increfs={0x40046304, 0x2}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000640)={@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0xfff, &(0x7f0000000540)=""/231, 0xe7, 0x1, 0x27}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000006c0)={0x0, 0x18, 0x40}}, 0x400}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fda={0x66646185, 0x0, 0x2, 0x2c}, @flat=@weak_handle={0x77682a85, 0xa, 0x1}, @fda={0x66646185, 0x5, 0x1, 0x10}}, &(0x7f0000000780)={0x0, 0x20, 0x38}}}, @increfs_done={0x40106308, 0x2}, @decrefs={0x40046307, 0x2}, @release], 0xed, 0x0, &(0x7f00000008c0)="bd4c44ead44a211cf04399a3a8a1f8b5accb6ec48b8ab4ee5b204a5e3397f6a6ce0d941ebef064f892f4e887123e063af702bb62a03a7e337ab9e2b956fabeefb34773fbb148fb90d4cb1aab5dc549a7d7538efb596641c9f536a651eb6d831830868c63d8cee80b1c6841b2181b273dc0487fb373bb36a5473a4ee272608c3d619dd25ab06bd6ee26288a39f0db307952be0e449743d44fea9a6c683dbade7ba9859a9a5a12c9f7bbf40fae6bacbfbb8934a335b0a59fe943fe6d86ad712110abe87f9c56d07fe51d76a952c2b772655633c6827f59a116f2cd11906505fdca771e77b37eff1ce353353f22c3"}) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6e}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfff}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4015) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000080)={"914477fd53093fff5ee31ea31df27b4dc3318d51f61407651f5bcbad9dda3670c05d9990d1d2636789e28d984f85defaed7678a1a5fb556c1e267ceff6947e22c03da6297d7cc289b4f177315c78dba99fa3da8a1428310dfe3552385465e9a7768a7898da6ab1699c7cc322f56d202b190708cff8f891bfe39836d20cc797e1f4e1912d0d54f89f42f31494f766f173263e74feee65f4d1e332ca8b7f79a5ca0e1d905fd3a8ebd7eb7b3ddfe67b93475f7c6c427feaf2564a96e19e4d3c2ec97f2a4ef5ade1115ad99e94f30c9f9bae154ce866a887a19e34066ae45a89d558ae910d1b22e0a0ccdb5b6df3984e8efb7cdfb662cd05c0cd2a03fbc89c8d7cfd07d7f5c9510f5301866dc22d4b498a00740949abb1a71c1e757b07f6b06f9dc14aa68859803b933dcf2d7a373bf982b873b92bc5c7cf4440eb3e17d68a504e40c20c18552a0ea9833b5f0231059bce284417b264d78d7257b30a130b9dfaea0d66afd38291f966914b6f62631b3fe90dbd1caff986a5c7d55c4b1585a2c208051192bffde34ffa8a7b0f6c9552a1298a73a15f3ed17ec0d92b508324b6e616de86e1ac986349011676eeb85a0304a684dc3bbd682e51b4e9a7d0389323ccb7686eeb770bf7c35675366e3ac2f0ec9a5151a5cb24e9a0a3a34838a6638e980d78c801ca00b8c48791d614761a24e7030c1cde9105cbf5fd558e7f55b72127ba6ffb9f7031631b364a93d712fefd43329427a691a23a6ada2b15ce92ceae84f04ab9da0ccf28f886cf10daf2f093629835a9a96531fe7e1655d66a6cf75ab1b1935da6308ce0b11ebdadbd6218bfa22b642b7ee58fb7553219ab39a5f64a9beb5f6cbb14056e178dd13ad1ae30fe1947ae3ef400ca96995e85ed161d003e52b0a96b56ac80ccea0d50b7eae4640b81bcf57b893365f839bc19b0f8fe6229d1c3e9c819cadcbb930775cba282e09c918fb682606bc0c19557ff4cc8260cbfedac1c0f55d497d2e0bb50666bf32e0143f8d06f77ba700388833a0e6c41478a87cd8e32e3d3d878e23fe5975dcc9ec97f0b34b73d00b966ac966bc4a1a0f694cab1122aad3e65aeb7cce8d0cb5f3b33b56f1aec68e1f01b567180e17476603a2b0cb1bf759b3f834bc5b3caa9c19e6d49330697a240b456ca97bad57bbe4c7968ba46c7b6c588119f4af1b1435d0446e9ad2e731409fd91a17f49c0a985ffa63b9f323c2048379e0a56b8876d66f040d59c6069b667c5ac8a36024d42c85e9f9cdb9154c64e810629d62eb2674e58f9c00a2463971c7450102af88fcec16eb459c17e0293de5e73a2bcf878b32904fdf8f907017a7ea26a2debbb80deae20da879ef66656e3fcba2727a26faf2b424ca9fb6938bf4e5b3d9ab5189c7bf095f0094809622f759ec0fe13ff497a0293e8b31240309121a45739bc6b361b818285e05e91"}) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000c40)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b00)={0xc8, r5, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA={0x2c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffffb}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x20}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x66cb7d0c}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:04 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40020d00}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x74, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7f}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x100000001}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x80}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x42}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000080}, 0x48001) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xc) [ 3390.958185] FAULT_INJECTION: forcing a failure. [ 3390.958185] name failslab, interval 1, probability 0, space 0, times 0 [ 3390.971338] CPU: 1 PID: 21389 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3390.979228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3390.988578] Call Trace: [ 3390.991171] dump_stack+0x1b2/0x281 [ 3390.994801] should_fail.cold+0x10a/0x149 [ 3390.998949] should_failslab+0xd6/0x130 [ 3391.002930] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3391.008035] __kmalloc_node+0x38/0x70 [ 3391.011837] blk_mq_alloc_tag_set+0x30f/0x910 [ 3391.016331] loop_add+0x2a0/0x830 [ 3391.019786] ? loop_queue_rq+0x280/0x280 [ 3391.023840] ? loop_queue_work+0x21e0/0x21e0 [ 3391.028249] loop_control_ioctl+0x11a/0x3f0 [ 3391.032569] ? loop_lookup+0x190/0x190 [ 3391.036453] ? SyS_write+0x1b7/0x210 [ 3391.040155] ? loop_lookup+0x190/0x190 [ 3391.044131] do_vfs_ioctl+0x75a/0xff0 [ 3391.047925] ? lock_acquire+0x170/0x3f0 [ 3391.051890] ? ioctl_preallocate+0x1a0/0x1a0 [ 3391.056302] ? __fget+0x265/0x3e0 [ 3391.059755] ? do_vfs_ioctl+0xff0/0xff0 [ 3391.063727] ? security_file_ioctl+0x83/0xb0 [ 3391.068130] SyS_ioctl+0x7f/0xb0 [ 3391.071482] ? do_vfs_ioctl+0xff0/0xff0 [ 3391.075436] do_syscall_64+0x1d5/0x640 [ 3391.079317] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3391.084482] RIP: 0033:0x7f0bff8e60c9 [ 3391.088167] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3391.095850] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 09:01:04 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:04 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40020d00}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x74, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7f}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x100000001}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x80}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x42}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000080}, 0x48001) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xc) 09:01:04 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) r4 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000009c0)={0xc4, 0x0, &(0x7f00000007c0)=[@increfs={0x40046304, 0x2}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000640)={@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0xfff, &(0x7f0000000540)=""/231, 0xe7, 0x1, 0x27}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000006c0)={0x0, 0x18, 0x40}}, 0x400}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fda={0x66646185, 0x0, 0x2, 0x2c}, @flat=@weak_handle={0x77682a85, 0xa, 0x1}, @fda={0x66646185, 0x5, 0x1, 0x10}}, &(0x7f0000000780)={0x0, 0x20, 0x38}}}, @increfs_done={0x40106308, 0x2}, @decrefs={0x40046307, 0x2}, @release], 0xed, 0x0, &(0x7f00000008c0)="bd4c44ead44a211cf04399a3a8a1f8b5accb6ec48b8ab4ee5b204a5e3397f6a6ce0d941ebef064f892f4e887123e063af702bb62a03a7e337ab9e2b956fabeefb34773fbb148fb90d4cb1aab5dc549a7d7538efb596641c9f536a651eb6d831830868c63d8cee80b1c6841b2181b273dc0487fb373bb36a5473a4ee272608c3d619dd25ab06bd6ee26288a39f0db307952be0e449743d44fea9a6c683dbade7ba9859a9a5a12c9f7bbf40fae6bacbfbb8934a335b0a59fe943fe6d86ad712110abe87f9c56d07fe51d76a952c2b772655633c6827f59a116f2cd11906505fdca771e77b37eff1ce353353f22c3"}) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6e}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfff}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4015) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000080)={"914477fd53093fff5ee31ea31df27b4dc3318d51f61407651f5bcbad9dda3670c05d9990d1d2636789e28d984f85defaed7678a1a5fb556c1e267ceff6947e22c03da6297d7cc289b4f177315c78dba99fa3da8a1428310dfe3552385465e9a7768a7898da6ab1699c7cc322f56d202b190708cff8f891bfe39836d20cc797e1f4e1912d0d54f89f42f31494f766f173263e74feee65f4d1e332ca8b7f79a5ca0e1d905fd3a8ebd7eb7b3ddfe67b93475f7c6c427feaf2564a96e19e4d3c2ec97f2a4ef5ade1115ad99e94f30c9f9bae154ce866a887a19e34066ae45a89d558ae910d1b22e0a0ccdb5b6df3984e8efb7cdfb662cd05c0cd2a03fbc89c8d7cfd07d7f5c9510f5301866dc22d4b498a00740949abb1a71c1e757b07f6b06f9dc14aa68859803b933dcf2d7a373bf982b873b92bc5c7cf4440eb3e17d68a504e40c20c18552a0ea9833b5f0231059bce284417b264d78d7257b30a130b9dfaea0d66afd38291f966914b6f62631b3fe90dbd1caff986a5c7d55c4b1585a2c208051192bffde34ffa8a7b0f6c9552a1298a73a15f3ed17ec0d92b508324b6e616de86e1ac986349011676eeb85a0304a684dc3bbd682e51b4e9a7d0389323ccb7686eeb770bf7c35675366e3ac2f0ec9a5151a5cb24e9a0a3a34838a6638e980d78c801ca00b8c48791d614761a24e7030c1cde9105cbf5fd558e7f55b72127ba6ffb9f7031631b364a93d712fefd43329427a691a23a6ada2b15ce92ceae84f04ab9da0ccf28f886cf10daf2f093629835a9a96531fe7e1655d66a6cf75ab1b1935da6308ce0b11ebdadbd6218bfa22b642b7ee58fb7553219ab39a5f64a9beb5f6cbb14056e178dd13ad1ae30fe1947ae3ef400ca96995e85ed161d003e52b0a96b56ac80ccea0d50b7eae4640b81bcf57b893365f839bc19b0f8fe6229d1c3e9c819cadcbb930775cba282e09c918fb682606bc0c19557ff4cc8260cbfedac1c0f55d497d2e0bb50666bf32e0143f8d06f77ba700388833a0e6c41478a87cd8e32e3d3d878e23fe5975dcc9ec97f0b34b73d00b966ac966bc4a1a0f694cab1122aad3e65aeb7cce8d0cb5f3b33b56f1aec68e1f01b567180e17476603a2b0cb1bf759b3f834bc5b3caa9c19e6d49330697a240b456ca97bad57bbe4c7968ba46c7b6c588119f4af1b1435d0446e9ad2e731409fd91a17f49c0a985ffa63b9f323c2048379e0a56b8876d66f040d59c6069b667c5ac8a36024d42c85e9f9cdb9154c64e810629d62eb2674e58f9c00a2463971c7450102af88fcec16eb459c17e0293de5e73a2bcf878b32904fdf8f907017a7ea26a2debbb80deae20da879ef66656e3fcba2727a26faf2b424ca9fb6938bf4e5b3d9ab5189c7bf095f0094809622f759ec0fe13ff497a0293e8b31240309121a45739bc6b361b818285e05e91"}) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000c40)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b00)={0xc8, r5, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA={0x2c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffffb}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x20}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x66cb7d0c}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) [ 3391.103093] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3391.110337] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3391.117593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3391.124842] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 09:01:04 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:04 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 4) 09:01:04 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 4: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40020d00}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x74, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7f}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x100000001}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x80}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x42}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000080}, 0x48001) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xc) 09:01:04 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff0020"], 0x1c}}, 0x0) 09:01:04 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() (async) 09:01:04 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() 09:01:04 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, 0x0) 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff0020"], 0x1c}}, 0x0) 09:01:04 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000009c0)={0xc4, 0x0, &(0x7f00000007c0)=[@increfs={0x40046304, 0x2}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000640)={@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0xfff, &(0x7f0000000540)=""/231, 0xe7, 0x1, 0x27}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000006c0)={0x0, 0x18, 0x40}}, 0x400}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fda={0x66646185, 0x0, 0x2, 0x2c}, @flat=@weak_handle={0x77682a85, 0xa, 0x1}, @fda={0x66646185, 0x5, 0x1, 0x10}}, &(0x7f0000000780)={0x0, 0x20, 0x38}}}, @increfs_done={0x40106308, 0x2}, @decrefs={0x40046307, 0x2}, @release], 0xed, 0x0, &(0x7f00000008c0)="bd4c44ead44a211cf04399a3a8a1f8b5accb6ec48b8ab4ee5b204a5e3397f6a6ce0d941ebef064f892f4e887123e063af702bb62a03a7e337ab9e2b956fabeefb34773fbb148fb90d4cb1aab5dc549a7d7538efb596641c9f536a651eb6d831830868c63d8cee80b1c6841b2181b273dc0487fb373bb36a5473a4ee272608c3d619dd25ab06bd6ee26288a39f0db307952be0e449743d44fea9a6c683dbade7ba9859a9a5a12c9f7bbf40fae6bacbfbb8934a335b0a59fe943fe6d86ad712110abe87f9c56d07fe51d76a952c2b772655633c6827f59a116f2cd11906505fdca771e77b37eff1ce353353f22c3"}) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6e}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfff}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4015) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000080)={"914477fd53093fff5ee31ea31df27b4dc3318d51f61407651f5bcbad9dda3670c05d9990d1d2636789e28d984f85defaed7678a1a5fb556c1e267ceff6947e22c03da6297d7cc289b4f177315c78dba99fa3da8a1428310dfe3552385465e9a7768a7898da6ab1699c7cc322f56d202b190708cff8f891bfe39836d20cc797e1f4e1912d0d54f89f42f31494f766f173263e74feee65f4d1e332ca8b7f79a5ca0e1d905fd3a8ebd7eb7b3ddfe67b93475f7c6c427feaf2564a96e19e4d3c2ec97f2a4ef5ade1115ad99e94f30c9f9bae154ce866a887a19e34066ae45a89d558ae910d1b22e0a0ccdb5b6df3984e8efb7cdfb662cd05c0cd2a03fbc89c8d7cfd07d7f5c9510f5301866dc22d4b498a00740949abb1a71c1e757b07f6b06f9dc14aa68859803b933dcf2d7a373bf982b873b92bc5c7cf4440eb3e17d68a504e40c20c18552a0ea9833b5f0231059bce284417b264d78d7257b30a130b9dfaea0d66afd38291f966914b6f62631b3fe90dbd1caff986a5c7d55c4b1585a2c208051192bffde34ffa8a7b0f6c9552a1298a73a15f3ed17ec0d92b508324b6e616de86e1ac986349011676eeb85a0304a684dc3bbd682e51b4e9a7d0389323ccb7686eeb770bf7c35675366e3ac2f0ec9a5151a5cb24e9a0a3a34838a6638e980d78c801ca00b8c48791d614761a24e7030c1cde9105cbf5fd558e7f55b72127ba6ffb9f7031631b364a93d712fefd43329427a691a23a6ada2b15ce92ceae84f04ab9da0ccf28f886cf10daf2f093629835a9a96531fe7e1655d66a6cf75ab1b1935da6308ce0b11ebdadbd6218bfa22b642b7ee58fb7553219ab39a5f64a9beb5f6cbb14056e178dd13ad1ae30fe1947ae3ef400ca96995e85ed161d003e52b0a96b56ac80ccea0d50b7eae4640b81bcf57b893365f839bc19b0f8fe6229d1c3e9c819cadcbb930775cba282e09c918fb682606bc0c19557ff4cc8260cbfedac1c0f55d497d2e0bb50666bf32e0143f8d06f77ba700388833a0e6c41478a87cd8e32e3d3d878e23fe5975dcc9ec97f0b34b73d00b966ac966bc4a1a0f694cab1122aad3e65aeb7cce8d0cb5f3b33b56f1aec68e1f01b567180e17476603a2b0cb1bf759b3f834bc5b3caa9c19e6d49330697a240b456ca97bad57bbe4c7968ba46c7b6c588119f4af1b1435d0446e9ad2e731409fd91a17f49c0a985ffa63b9f323c2048379e0a56b8876d66f040d59c6069b667c5ac8a36024d42c85e9f9cdb9154c64e810629d62eb2674e58f9c00a2463971c7450102af88fcec16eb459c17e0293de5e73a2bcf878b32904fdf8f907017a7ea26a2debbb80deae20da879ef66656e3fcba2727a26faf2b424ca9fb6938bf4e5b3d9ab5189c7bf095f0094809622f759ec0fe13ff497a0293e8b31240309121a45739bc6b361b818285e05e91"}) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000c40)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b00)={0xc8, r5, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA={0x2c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffffb}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x20}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x66cb7d0c}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) [ 3391.298527] FAULT_INJECTION: forcing a failure. [ 3391.298527] name failslab, interval 1, probability 0, space 0, times 0 [ 3391.313638] CPU: 1 PID: 21418 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3391.321526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3391.330878] Call Trace: [ 3391.333458] dump_stack+0x1b2/0x281 [ 3391.337065] should_fail.cold+0x10a/0x149 [ 3391.341215] should_failslab+0xd6/0x130 [ 3391.345169] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3391.350249] blk_mq_init_tags+0x5e/0x280 [ 3391.354286] blk_mq_alloc_rq_map+0x90/0x220 [ 3391.358587] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 3391.363156] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3391.367636] loop_add+0x2a0/0x830 [ 3391.371065] ? loop_queue_rq+0x280/0x280 [ 3391.375110] ? loop_queue_work+0x21e0/0x21e0 [ 3391.379504] loop_control_ioctl+0x11a/0x3f0 [ 3391.383809] ? loop_lookup+0x190/0x190 [ 3391.387680] ? SyS_write+0x1b7/0x210 [ 3391.391382] ? loop_lookup+0x190/0x190 [ 3391.395464] do_vfs_ioctl+0x75a/0xff0 [ 3391.399273] ? lock_acquire+0x170/0x3f0 [ 3391.403227] ? ioctl_preallocate+0x1a0/0x1a0 [ 3391.407615] ? __fget+0x265/0x3e0 [ 3391.411044] ? do_vfs_ioctl+0xff0/0xff0 [ 3391.414999] ? security_file_ioctl+0x83/0xb0 [ 3391.419386] SyS_ioctl+0x7f/0xb0 [ 3391.422739] ? do_vfs_ioctl+0xff0/0xff0 [ 3391.426698] do_syscall_64+0x1d5/0x640 [ 3391.430570] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3391.435735] RIP: 0033:0x7f0bff8e60c9 [ 3391.439424] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:04 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) r3 = getuid() r4 = getuid() setresuid(r3, r4, 0xee00) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) getresuid(&(0x7f00000001c0), &(0x7f0000000200)=0x0, &(0x7f0000000240)) setresuid(r2, r5, r6) r7 = getuid() setresuid(r2, r7, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3391.447110] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3391.454358] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3391.461611] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3391.468861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3391.476210] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3391.493234] blk-mq: reduced tag depth (128 -> 64) 09:01:04 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x43, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:04 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 5) 09:01:04 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, 0x0) 09:01:04 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) (async) r3 = getuid() (async) r4 = getuid() setresuid(r3, r4, 0xee00) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) (async) getresuid(&(0x7f00000001c0), &(0x7f0000000200)=0x0, &(0x7f0000000240)) setresuid(r2, r5, r6) (async) r7 = getuid() setresuid(r2, r7, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff0020"], 0x1c}}, 0x0) 09:01:04 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) (async) r3 = getuid() (async) r4 = getuid() setresuid(r3, r4, 0xee00) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) (async) getresuid(&(0x7f00000001c0), &(0x7f0000000200)=0x0, &(0x7f0000000240)) setresuid(r2, r5, r6) r7 = getuid() setresuid(r2, r7, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffffffb) 09:01:04 executing program 2: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x20}, @NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000013}, 0x44012) setresuid(0x0, 0xee01, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r5 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r4, 0x7014) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r4) sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r6, 0x631, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40040080) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008647b3bfe"], 0x1c}}, 0x0) 09:01:04 executing program 2: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x20}, @NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000013}, 0x44012) (async) setresuid(0x0, 0xee01, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) (async) pipe(&(0x7f0000000200)={0xffffffffffffffff}) (async) r5 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r4, 0x7014) (async) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r4) sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r6, 0x631, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40040080) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:04 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, 0x0) 09:01:04 executing program 2: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x20}, @NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000013}, 0x44012) setresuid(0x0, 0xee01, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r5 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) ioctl$RTC_VL_CLR(r4, 0x7014) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r4) sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r6, 0x631, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40040080) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x20}, @NBD_ATTR_BACKEND_IDENTIFIER={0x10, 0xa, './binderfs2\x00'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000013}, 0x44012) (async) setresuid(0x0, 0xee01, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r1) (async) pipe(&(0x7f0000000200)) (async) socket(0x6, 0x3, 0xae) (async) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async) ioctl$RTC_VL_CLR(r4, 0x7014) (async) syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r4) (async) sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r6, 0x631, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40040080) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:05 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x43, 0x0) (async) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) [ 3391.687002] FAULT_INJECTION: forcing a failure. [ 3391.687002] name failslab, interval 1, probability 0, space 0, times 0 [ 3391.709828] CPU: 0 PID: 21473 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3391.717727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3391.727068] Call Trace: [ 3391.729641] dump_stack+0x1b2/0x281 [ 3391.733249] should_fail.cold+0x10a/0x149 [ 3391.737384] should_failslab+0xd6/0x130 [ 3391.741351] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3391.746480] __kmalloc_node+0x38/0x70 [ 3391.750268] sbitmap_init_node+0x10c/0x3d0 [ 3391.754483] sbitmap_queue_init_node+0x37/0x5d0 [ 3391.759138] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 3391.764139] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 3391.769403] blk_mq_init_tags+0xf4/0x280 [ 3391.773444] blk_mq_alloc_rq_map+0x90/0x220 [ 3391.777750] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 3391.782231] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3391.786710] loop_add+0x2a0/0x830 [ 3391.790142] ? loop_queue_rq+0x280/0x280 [ 3391.794176] ? loop_queue_work+0x21e0/0x21e0 [ 3391.798572] loop_control_ioctl+0x11a/0x3f0 [ 3391.802889] ? loop_lookup+0x190/0x190 [ 3391.806751] ? SyS_write+0x1b7/0x210 [ 3391.810442] ? loop_lookup+0x190/0x190 [ 3391.814316] do_vfs_ioctl+0x75a/0xff0 [ 3391.818104] ? lock_acquire+0x170/0x3f0 [ 3391.822067] ? ioctl_preallocate+0x1a0/0x1a0 [ 3391.826452] ? __fget+0x265/0x3e0 [ 3391.829885] ? do_vfs_ioctl+0xff0/0xff0 [ 3391.833836] ? security_file_ioctl+0x83/0xb0 [ 3391.838228] SyS_ioctl+0x7f/0xb0 [ 3391.841578] ? do_vfs_ioctl+0xff0/0xff0 [ 3391.845527] do_syscall_64+0x1d5/0x640 [ 3391.849406] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3391.854569] RIP: 0033:0x7f0bff8e60c9 [ 3391.858257] RSP: 002b:00007f0bfde37168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3391.865973] RAX: ffffffffffffffda RBX: 00007f0bffa06050 RCX: 00007f0bff8e60c9 [ 3391.873220] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3391.880476] RBP: 00007f0bfde371d0 R08: 0000000000000000 R09: 0000000000000000 09:01:05 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 6) 09:01:05 executing program 2: getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000100)=0x0) r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(r0, r1, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() [ 3391.887735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3391.895068] R13: 00007ffce046c59f R14: 00007f0bfde37300 R15: 0000000000022000 [ 3391.903886] blk-mq: reduced tag depth (128 -> 64) 09:01:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:05 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffffffb) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffffffb) (async) 09:01:05 executing program 2: getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000100)=0x0) r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) (async) setresuid(r0, r1, r0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() 09:01:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffff"], 0x1c}}, 0x0) 09:01:05 executing program 2: getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000100)=0x0) (async) r1 = getuid() (async) r2 = getuid() setresuid(r1, r2, 0xee00) (async) setresuid(r0, r1, r0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() 09:01:05 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) 09:01:05 executing program 2: setresuid(0x0, 0xee01, 0x0) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:05 executing program 2: setresuid(0x0, 0xee01, 0x0) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:05 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x43, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x43, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) [ 3392.053993] FAULT_INJECTION: forcing a failure. [ 3392.053993] name failslab, interval 1, probability 0, space 0, times 0 [ 3392.072101] CPU: 0 PID: 21524 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3392.080007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3392.089362] Call Trace: [ 3392.091942] dump_stack+0x1b2/0x281 [ 3392.095554] should_fail.cold+0x10a/0x149 [ 3392.099683] should_failslab+0xd6/0x130 [ 3392.103635] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3392.108728] sbitmap_queue_init_node+0x27f/0x5d0 [ 3392.113464] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 3392.118809] blk_mq_init_tags+0xf4/0x280 [ 3392.122859] blk_mq_alloc_rq_map+0x90/0x220 [ 3392.127164] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 3392.131645] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3392.136127] loop_add+0x2a0/0x830 [ 3392.139558] ? loop_queue_rq+0x280/0x280 [ 3392.143612] ? loop_queue_work+0x21e0/0x21e0 [ 3392.148019] loop_control_ioctl+0x11a/0x3f0 [ 3392.152325] ? loop_lookup+0x190/0x190 [ 3392.156194] ? SyS_write+0x1b7/0x210 [ 3392.159883] ? loop_lookup+0x190/0x190 [ 3392.163753] do_vfs_ioctl+0x75a/0xff0 [ 3392.167531] ? lock_acquire+0x170/0x3f0 [ 3392.171481] ? ioctl_preallocate+0x1a0/0x1a0 [ 3392.175866] ? __fget+0x265/0x3e0 [ 3392.179299] ? do_vfs_ioctl+0xff0/0xff0 [ 3392.183257] ? security_file_ioctl+0x83/0xb0 [ 3392.187642] SyS_ioctl+0x7f/0xb0 [ 3392.190982] ? do_vfs_ioctl+0xff0/0xff0 [ 3392.194932] do_syscall_64+0x1d5/0x640 [ 3392.198799] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 09:01:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffff"], 0x1c}}, 0x0) [ 3392.203962] RIP: 0033:0x7f0bff8e60c9 [ 3392.207651] RSP: 002b:00007f0bfde37168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3392.215335] RAX: ffffffffffffffda RBX: 00007f0bffa06050 RCX: 00007f0bff8e60c9 [ 3392.222586] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3392.229832] RBP: 00007f0bfde371d0 R08: 0000000000000000 R09: 0000000000000000 [ 3392.237077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3392.244327] R13: 00007ffce046c59f R14: 00007f0bfde37300 R15: 0000000000022000 09:01:05 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 7) 09:01:05 executing program 2: setresuid(0x0, 0xee01, 0x0) getuid() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:05 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000140)) [ 3392.268179] blk-mq: reduced tag depth (128 -> 64) 09:01:05 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffffffb) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffffffb) (async) 09:01:05 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/114, 0x72}], 0x1}, 0x100) 09:01:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffff"], 0x1c}}, 0x0) 09:01:05 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:05 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/114, 0x72}], 0x1}, 0x100) 09:01:05 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (fail_nth: 1) 09:01:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff00"], 0x1c}}, 0x0) [ 3392.392504] FAULT_INJECTION: forcing a failure. [ 3392.392504] name failslab, interval 1, probability 0, space 0, times 0 [ 3392.410879] CPU: 0 PID: 21564 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3392.418782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3392.428137] Call Trace: [ 3392.430730] dump_stack+0x1b2/0x281 [ 3392.434371] should_fail.cold+0x10a/0x149 [ 3392.438529] should_failslab+0xd6/0x130 09:01:05 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/114, 0x72}], 0x1}, 0x100) 09:01:05 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x0) setresuid(r0, r1, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs\x00', 0x1ff) [ 3392.442503] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3392.447606] sbitmap_queue_init_node+0x27f/0x5d0 [ 3392.452362] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 3392.457644] blk_mq_init_tags+0x14b/0x280 [ 3392.461840] blk_mq_alloc_rq_map+0x90/0x220 [ 3392.466162] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 3392.470656] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3392.475144] loop_add+0x2a0/0x830 [ 3392.478584] ? loop_queue_rq+0x280/0x280 [ 3392.482642] ? loop_queue_work+0x21e0/0x21e0 [ 3392.487242] loop_control_ioctl+0x11a/0x3f0 [ 3392.491560] ? loop_lookup+0x190/0x190 [ 3392.495445] ? SyS_write+0x1b7/0x210 [ 3392.499156] ? loop_lookup+0x190/0x190 [ 3392.503036] do_vfs_ioctl+0x75a/0xff0 [ 3392.508134] ? lock_acquire+0x170/0x3f0 [ 3392.512118] ? ioctl_preallocate+0x1a0/0x1a0 [ 3392.516703] ? __fget+0x265/0x3e0 [ 3392.520160] ? do_vfs_ioctl+0xff0/0xff0 [ 3392.524133] ? security_file_ioctl+0x83/0xb0 [ 3392.528533] SyS_ioctl+0x7f/0xb0 [ 3392.531882] ? do_vfs_ioctl+0xff0/0xff0 [ 3392.535838] do_syscall_64+0x1d5/0x640 [ 3392.539721] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3392.545073] RIP: 0033:0x7f0bff8e60c9 [ 3392.548759] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3392.556573] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3392.563828] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3392.571074] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3392.578325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 09:01:05 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 8) 09:01:05 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x0) setresuid(r0, r1, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs\x00', 0x1ff) 09:01:05 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x0) setresuid(r0, r1, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs\x00', 0x1ff) [ 3392.585582] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3392.608709] blk-mq: reduced tag depth (128 -> 64) 09:01:05 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), r0) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="100027bdee07fddbdf25020000000800080000000000050002000a000000"], 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4801) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RTC_PIE_ON(r1, 0x7005) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:05 executing program 2: openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x280082, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x400, 0x70bd2b, 0x25dfdc00}, 0x14}, 0x1, 0x0, 0x0, 0x4040880}, 0x8040) 09:01:05 executing program 2: openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x280082, 0x0) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x400, 0x70bd2b, 0x25dfdc00}, 0x14}, 0x1, 0x0, 0x0, 0x4040880}, 0x8040) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x280082, 0x0) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x400, 0x70bd2b, 0x25dfdc00}, 0x14}, 0x1, 0x0, 0x0, 0x4040880}, 0x8040) (async) 09:01:06 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:06 executing program 2: openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x280082, 0x0) (async, rerun: 32) setresuid(0x0, 0xee01, 0x0) (rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x400, 0x70bd2b, 0x25dfdc00}, 0x14}, 0x1, 0x0, 0x0, 0x4040880}, 0x8040) 09:01:06 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth1_to_batadv\x00'}) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000140)) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000240)) syz_open_dev$media(&(0x7f0000000200), 0xffffffffffffffff, 0x1) r3 = syz_open_dev$mouse(&(0x7f00000002c0), 0x8, 0x1) inotify_add_watch(r3, &(0x7f0000000300)='.\x00', 0x20000080) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400c1a4d704", @ANYRES16=0x0, @ANYBLOB="00042dbd7000ffdbdf250600000006001d000300000005000400a1000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20) 09:01:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff00"], 0x1c}}, 0x0) 09:01:06 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) 09:01:06 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), r0) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="100027bdee07fddbdf25020000000800080000000000050002000a000000"], 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4801) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RTC_PIE_ON(r1, 0x7005) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r0) (async) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="100027bdee07fddbdf25020000000800080000000000050002000a000000"], 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4801) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_PIE_ON(r1, 0x7005) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) [ 3392.801216] FAULT_INJECTION: forcing a failure. [ 3392.801216] name failslab, interval 1, probability 0, space 0, times 0 [ 3392.830574] CPU: 1 PID: 21610 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3392.838469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3392.847809] Call Trace: [ 3392.850387] dump_stack+0x1b2/0x281 [ 3392.853992] should_fail.cold+0x10a/0x149 [ 3392.858118] should_failslab+0xd6/0x130 [ 3392.862079] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3392.867167] __kmalloc_node+0x38/0x70 [ 3392.870952] blk_mq_alloc_rq_map+0xd2/0x220 [ 3392.875259] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 3392.879735] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3392.884210] loop_add+0x2a0/0x830 [ 3392.887641] ? loop_queue_rq+0x280/0x280 [ 3392.891682] ? loop_queue_work+0x21e0/0x21e0 [ 3392.896072] loop_control_ioctl+0x11a/0x3f0 [ 3392.900378] ? loop_lookup+0x190/0x190 [ 3392.904248] ? SyS_write+0x1b7/0x210 [ 3392.907938] ? loop_lookup+0x190/0x190 [ 3392.911800] do_vfs_ioctl+0x75a/0xff0 [ 3392.915579] ? lock_acquire+0x170/0x3f0 [ 3392.919529] ? ioctl_preallocate+0x1a0/0x1a0 [ 3392.923918] ? __fget+0x265/0x3e0 [ 3392.927352] ? do_vfs_ioctl+0xff0/0xff0 [ 3392.931305] ? security_file_ioctl+0x83/0xb0 [ 3392.935788] SyS_ioctl+0x7f/0xb0 [ 3392.939130] ? do_vfs_ioctl+0xff0/0xff0 [ 3392.943081] do_syscall_64+0x1d5/0x640 [ 3392.946947] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3392.952115] RIP: 0033:0x7f0bff8e60c9 [ 3392.955806] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3392.963487] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3392.970733] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3392.977986] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3392.985236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3392.992484] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:06 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 9) 09:01:06 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) (async) 09:01:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff00"], 0x1c}}, 0x0) [ 3393.013426] blk-mq: reduced tag depth (128 -> 64) 09:01:06 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) (rerun: 32) 09:01:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff0020"], 0x1c}}, 0x0) 09:01:06 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth1_to_batadv\x00'}) (async) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000140)) (async) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000240)) (async) syz_open_dev$media(&(0x7f0000000200), 0xffffffffffffffff, 0x1) (async) r3 = syz_open_dev$mouse(&(0x7f00000002c0), 0x8, 0x1) inotify_add_watch(r3, &(0x7f0000000300)='.\x00', 0x20000080) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400c1a4d704", @ANYRES16=0x0, @ANYBLOB="00042dbd7000ffdbdf250600000006001d000300000005000400a1000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20) 09:01:06 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:06 executing program 2: seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)=0x81) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:06 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), r0) sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="100027bdee07fddbdf25020000000800080000000000050002000a000000"], 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4801) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_PIE_ON(r1, 0x7005) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) [ 3393.152564] FAULT_INJECTION: forcing a failure. [ 3393.152564] name failslab, interval 1, probability 0, space 0, times 0 [ 3393.169188] CPU: 0 PID: 21659 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3393.177093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3393.186451] Call Trace: [ 3393.189037] dump_stack+0x1b2/0x281 [ 3393.192667] should_fail.cold+0x10a/0x149 [ 3393.196852] should_failslab+0xd6/0x130 09:01:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff0020"], 0x1c}}, 0x0) 09:01:06 executing program 2: seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)=0x81) (async) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:06 executing program 2: seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)=0x81) (async) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3393.200830] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3393.205932] __kmalloc_node+0x38/0x70 [ 3393.209737] blk_mq_alloc_rq_map+0x113/0x220 [ 3393.214142] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 3393.218627] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3393.223375] loop_add+0x2a0/0x830 [ 3393.226828] ? loop_queue_rq+0x280/0x280 [ 3393.230879] ? loop_queue_work+0x21e0/0x21e0 [ 3393.235282] loop_control_ioctl+0x11a/0x3f0 [ 3393.239595] ? loop_lookup+0x190/0x190 [ 3393.243471] ? SyS_write+0x1b7/0x210 [ 3393.247179] ? loop_lookup+0x190/0x190 [ 3393.251057] do_vfs_ioctl+0x75a/0xff0 [ 3393.254850] ? lock_acquire+0x170/0x3f0 [ 3393.258822] ? ioctl_preallocate+0x1a0/0x1a0 [ 3393.263216] ? __fget+0x265/0x3e0 [ 3393.266648] ? do_vfs_ioctl+0xff0/0xff0 [ 3393.270609] ? security_file_ioctl+0x83/0xb0 [ 3393.275009] SyS_ioctl+0x7f/0xb0 [ 3393.278366] ? do_vfs_ioctl+0xff0/0xff0 [ 3393.282329] do_syscall_64+0x1d5/0x640 [ 3393.286198] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3393.291369] RIP: 0033:0x7f0bff8e60c9 [ 3393.295052] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:06 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 10) 09:01:06 executing program 2: r0 = getuid() getuid() r1 = getuid() setresuid(r0, r1, 0xee00) set_robust_list(&(0x7f0000000140)={&(0x7f0000000080), 0x8, &(0x7f0000000100)={&(0x7f00000000c0)}}, 0x18) setresuid(0x0, 0xee01, r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$inet_udp(0x2, 0x2, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3393.302736] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3393.309987] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3393.317245] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3393.324494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3393.331747] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3393.340121] blk-mq: reduced tag depth (128 -> 64) 09:01:06 executing program 2: r0 = getuid() (async) getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) set_robust_list(&(0x7f0000000140)={&(0x7f0000000080), 0x8, &(0x7f0000000100)={&(0x7f00000000c0)}}, 0x18) (async) setresuid(0x0, 0xee01, r0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$inet_udp(0x2, 0x2, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff0020"], 0x1c}}, 0x0) 09:01:06 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)={'erspan0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @private}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000100)={'gre0\x00', r2, 0x20, 0x8000, 0x8d08, 0x40, {{0x26, 0x4, 0x1, 0x3, 0x98, 0x64, 0x0, 0x1, 0x2f, 0x0, @multicast2, @loopback, {[@cipso={0x86, 0xa, 0x3, [{0x1, 0x4, '\ru'}]}, @timestamp_addr={0x44, 0x4c, 0x18, 0x1, 0x5, [{@dev={0xac, 0x14, 0x14, 0x34}, 0x6}, {@broadcast, 0x9e}, {@loopback, 0x10001}, {@remote, 0x18}, {@private=0xa010100, 0x8}, {@local, 0x4}, {@multicast2, 0x9}, {@multicast1, 0x8}, {@remote, 0x2}]}, @ssrr={0x89, 0x7, 0xdd, [@private=0x9]}, @cipso={0x86, 0x24, 0x0, [{0x0, 0xd, "62431e52bb74ebd6fa9f54"}, {0x1, 0x11, "b4459b332866beee01c7b5e8cd2a6c"}]}]}}}}}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f0000000080)=0x7) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:06 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth1_to_batadv\x00'}) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000140)) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f0000000240)) (async) syz_open_dev$media(&(0x7f0000000200), 0xffffffffffffffff, 0x1) (async) r3 = syz_open_dev$mouse(&(0x7f00000002c0), 0x8, 0x1) inotify_add_watch(r3, &(0x7f0000000300)='.\x00', 0x20000080) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400c1a4d704", @ANYRES16=0x0, @ANYBLOB="00042dbd7000ffdbdf250600000006001d000300000005000400a1000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20) 09:01:06 executing program 2: r0 = getuid() getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) set_robust_list(&(0x7f0000000140)={&(0x7f0000000080), 0x8, &(0x7f0000000100)={&(0x7f00000000c0)}}, 0x18) (async) setresuid(0x0, 0xee01, r0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$inet_udp(0x2, 0x2, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:06 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x4, 0x4000) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}}, 0x10) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:06 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4200}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf25030000000c0002000100000000000000", @ANYRESDEC=r1], 0x20}, 0x1, 0x0, 0x0, 0x4040051}, 0x4040050) syz_open_dev$loop(&(0x7f0000000180), 0xfff, 0x440001) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x3) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000000)) 09:01:06 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x4, 0x4000) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}}, 0x10) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) syz_open_dev$mouse(&(0x7f0000000000), 0x4, 0x4000) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}}, 0x10) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:06 executing program 0: sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400e010}, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3393.524584] FAULT_INJECTION: forcing a failure. [ 3393.524584] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3393.549833] CPU: 1 PID: 21719 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3393.557739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3393.567080] Call Trace: [ 3393.569650] dump_stack+0x1b2/0x281 [ 3393.573262] should_fail.cold+0x10a/0x149 [ 3393.577393] __alloc_pages_nodemask+0x21e/0x2900 [ 3393.582130] ? __kmalloc_node+0x4c/0x70 [ 3393.586083] ? blk_mq_alloc_rq_map+0x113/0x220 [ 3393.590646] ? blk_mq_alloc_tag_set+0x4ac/0x910 [ 3393.595291] ? loop_add+0x2a0/0x830 [ 3393.598891] ? loop_control_ioctl+0x11a/0x3f0 [ 3393.603363] ? do_syscall_64+0x1d5/0x640 [ 3393.607404] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3393.612744] ? __mutex_unlock_slowpath+0x75/0x770 [ 3393.617565] ? fs_reclaim_release+0xd0/0x110 [ 3393.621948] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 3393.626768] ? __lockdep_init_map+0x100/0x560 [ 3393.631277] ? _find_next_bit+0xdb/0x100 [ 3393.635320] ? __cpu_to_node+0x7b/0xa0 [ 3393.639184] ? blk_mq_hw_queue_to_node+0x9f/0xf0 [ 3393.643915] blk_mq_alloc_rqs+0x227/0x6d0 [ 3393.648048] ? blk_mq_alloc_rq_map+0x9d/0x220 [ 3393.652522] __blk_mq_alloc_rq_map+0x15b/0x3a0 [ 3393.657088] blk_mq_alloc_tag_set+0x4ac/0x910 [ 3393.661569] loop_add+0x2a0/0x830 [ 3393.665001] ? loop_queue_rq+0x280/0x280 [ 3393.669037] ? loop_queue_work+0x21e0/0x21e0 [ 3393.673426] loop_control_ioctl+0x11a/0x3f0 [ 3393.677721] ? loop_lookup+0x190/0x190 [ 3393.681587] ? SyS_write+0x1b7/0x210 [ 3393.685276] ? loop_lookup+0x190/0x190 [ 3393.689144] do_vfs_ioctl+0x75a/0xff0 [ 3393.692920] ? lock_acquire+0x170/0x3f0 [ 3393.696870] ? ioctl_preallocate+0x1a0/0x1a0 [ 3393.701277] ? __fget+0x265/0x3e0 [ 3393.704709] ? do_vfs_ioctl+0xff0/0xff0 [ 3393.708669] ? security_file_ioctl+0x83/0xb0 [ 3393.713058] SyS_ioctl+0x7f/0xb0 [ 3393.716399] ? do_vfs_ioctl+0xff0/0xff0 [ 3393.720355] do_syscall_64+0x1d5/0x640 [ 3393.724222] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3393.729393] RIP: 0033:0x7f0bff8e60c9 [ 3393.733084] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3393.740765] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3393.748009] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3393.755262] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3393.762511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:07 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 11) 09:01:07 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x4, 0x4000) (async) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}}, 0x10) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:07 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4200}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf25030000000c0002000100000000000000", @ANYRESDEC=r1], 0x20}, 0x1, 0x0, 0x0, 0x4040051}, 0x4040050) syz_open_dev$loop(&(0x7f0000000180), 0xfff, 0x440001) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x3) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4200}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf25030000000c0002000100000000000000", @ANYRESDEC=r1], 0x20}, 0x1, 0x0, 0x0, 0x4040051}, 0x4040050) (async) syz_open_dev$loop(&(0x7f0000000180), 0xfff, 0x440001) (async) pipe(&(0x7f0000000ac0)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x3) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000000)) (async) [ 3393.769772] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:07 executing program 0: sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400e010}, 0x0) (async) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:07 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)={'erspan0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @private}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000100)={'gre0\x00', r2, 0x20, 0x8000, 0x8d08, 0x40, {{0x26, 0x4, 0x1, 0x3, 0x98, 0x64, 0x0, 0x1, 0x2f, 0x0, @multicast2, @loopback, {[@cipso={0x86, 0xa, 0x3, [{0x1, 0x4, '\ru'}]}, @timestamp_addr={0x44, 0x4c, 0x18, 0x1, 0x5, [{@dev={0xac, 0x14, 0x14, 0x34}, 0x6}, {@broadcast, 0x9e}, {@loopback, 0x10001}, {@remote, 0x18}, {@private=0xa010100, 0x8}, {@local, 0x4}, {@multicast2, 0x9}, {@multicast1, 0x8}, {@remote, 0x2}]}, @ssrr={0x89, 0x7, 0xdd, [@private=0x9]}, @cipso={0x86, 0x24, 0x0, [{0x0, 0xd, "62431e52bb74ebd6fa9f54"}, {0x1, 0x11, "b4459b332866beee01c7b5e8cd2a6c"}]}]}}}}}) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f0000000080)=0x7) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:07 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x298880) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000080)) 09:01:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:07 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x298880) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000080)) 09:01:07 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000200)={'erspan0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @private}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000100)={'gre0\x00', r2, 0x20, 0x8000, 0x8d08, 0x40, {{0x26, 0x4, 0x1, 0x3, 0x98, 0x64, 0x0, 0x1, 0x2f, 0x0, @multicast2, @loopback, {[@cipso={0x86, 0xa, 0x3, [{0x1, 0x4, '\ru'}]}, @timestamp_addr={0x44, 0x4c, 0x18, 0x1, 0x5, [{@dev={0xac, 0x14, 0x14, 0x34}, 0x6}, {@broadcast, 0x9e}, {@loopback, 0x10001}, {@remote, 0x18}, {@private=0xa010100, 0x8}, {@local, 0x4}, {@multicast2, 0x9}, {@multicast1, 0x8}, {@remote, 0x2}]}, @ssrr={0x89, 0x7, 0xdd, [@private=0x9]}, @cipso={0x86, 0x24, 0x0, [{0x0, 0xd, "62431e52bb74ebd6fa9f54"}, {0x1, 0x11, "b4459b332866beee01c7b5e8cd2a6c"}]}]}}}}}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f0000000080)=0x7) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:07 executing program 0: sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400e010}, 0x0) (async) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:07 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x298880) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000080)) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x298880) (async) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000080)) (async) [ 3393.944898] FAULT_INJECTION: forcing a failure. [ 3393.944898] name failslab, interval 1, probability 0, space 0, times 0 [ 3393.969087] CPU: 0 PID: 21751 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3393.976985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3393.986340] Call Trace: [ 3393.988932] dump_stack+0x1b2/0x281 [ 3393.992561] should_fail.cold+0x10a/0x149 [ 3393.996705] should_failslab+0xd6/0x130 [ 3394.000673] kmem_cache_alloc_node+0x263/0x410 [ 3394.005256] blk_alloc_queue_node+0x2d/0xb40 [ 3394.009672] blk_mq_init_queue+0x42/0x90 [ 3394.013737] loop_add+0x303/0x830 [ 3394.017192] ? loop_queue_rq+0x280/0x280 [ 3394.021236] ? loop_queue_work+0x21e0/0x21e0 [ 3394.025626] loop_control_ioctl+0x11a/0x3f0 [ 3394.029923] ? loop_lookup+0x190/0x190 [ 3394.033790] ? SyS_write+0x1b7/0x210 [ 3394.037487] ? loop_lookup+0x190/0x190 [ 3394.041368] do_vfs_ioctl+0x75a/0xff0 [ 3394.045155] ? lock_acquire+0x170/0x3f0 [ 3394.049105] ? ioctl_preallocate+0x1a0/0x1a0 [ 3394.053493] ? __fget+0x265/0x3e0 [ 3394.056923] ? do_vfs_ioctl+0xff0/0xff0 [ 3394.060877] ? security_file_ioctl+0x83/0xb0 [ 3394.065266] SyS_ioctl+0x7f/0xb0 [ 3394.068609] ? do_vfs_ioctl+0xff0/0xff0 [ 3394.072559] do_syscall_64+0x1d5/0x640 [ 3394.076425] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3394.081589] RIP: 0033:0x7f0bff8e60c9 [ 3394.085277] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:07 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 12) 09:01:07 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(0x0, r0, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3394.092962] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3394.100211] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3394.107463] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3394.114712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3394.121959] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:07 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4200}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf25030000000c0002000100000000000000", @ANYRESDEC=r1], 0x20}, 0x1, 0x0, 0x0, 0x4040051}, 0x4040050) syz_open_dev$loop(&(0x7f0000000180), 0xfff, 0x440001) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x3) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4200}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16=0x0, @ANYBLOB="000428bd7000fedbdf25030000000c0002000100000000000000", @ANYRESDEC=r1], 0x20}, 0x1, 0x0, 0x0, 0x4040051}, 0x4040050) (async) syz_open_dev$loop(&(0x7f0000000180), 0xfff, 0x440001) (async) pipe(&(0x7f0000000ac0)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x3) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000000)) (async) 09:01:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x204000) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) 09:01:07 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) r1 = getuid() (async) r2 = getuid() setresuid(r1, r2, 0xee00) (async) setresuid(0x0, r0, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:07 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x8850) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:07 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(0x0, r0, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) getuid() (async) getuid() (async) setresuid(r1, r2, 0xee00) (async) setresuid(0x0, r0, r2) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:07 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f00000012c0)={0x8, 0x5c, "c408f8e36687457f1fd317a170e0551a59efcbf990ebcbe5ac6758a3a7e3608d917aba2d4949500e1a3a5f2c10ce8623d9baeaf1d4c93b2ce4dda7c5777385213e541b2cf942e31ddf6972f41b0dfc771027cc4c6c2beb3e769728d6"}) socket$l2tp6(0xa, 0x2, 0x73) recvmsg$unix(r1, &(0x7f0000001340)={&(0x7f00000015c0), 0x6e, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/15, 0xf}, {&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/174, 0xae}, {&(0x7f00000011c0)=""/157, 0x9d}], 0x4, &(0x7f0000001500)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x68}, 0x102) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000001480)=@multiplanar_userptr={0xf8, 0x2, 0x4, 0x400, 0x3902, {0x77359400}, {0x2, 0x1, 0x7, 0xaf, 0x80, 0x7, "0dcdf746"}, 0x8001, 0x2, {&(0x7f0000001400)=[{0x7, 0x401, {&(0x7f0000001380)}, 0x100}, {0x446, 0x6, {&(0x7f00000013c0)}, 0xfffffffd}]}, 0x152}) 09:01:07 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x80000, 0x9) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x8850) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) [ 3394.298378] FAULT_INJECTION: forcing a failure. [ 3394.298378] name failslab, interval 1, probability 0, space 0, times 0 [ 3394.314373] CPU: 1 PID: 21814 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3394.322273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3394.331606] Call Trace: [ 3394.334177] dump_stack+0x1b2/0x281 [ 3394.337781] should_fail.cold+0x10a/0x149 [ 3394.341908] should_failslab+0xd6/0x130 [ 3394.345862] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3394.350513] bioset_create+0x53/0x750 [ 3394.354291] ? kmem_cache_alloc_node+0x38b/0x410 [ 3394.359025] blk_alloc_queue_node+0xa8/0xb40 [ 3394.363426] blk_mq_init_queue+0x42/0x90 [ 3394.367482] loop_add+0x303/0x830 [ 3394.370910] ? loop_queue_rq+0x280/0x280 [ 3394.374946] ? loop_queue_work+0x21e0/0x21e0 [ 3394.379331] loop_control_ioctl+0x11a/0x3f0 [ 3394.383626] ? loop_lookup+0x190/0x190 [ 3394.387509] ? SyS_write+0x1b7/0x210 [ 3394.391198] ? loop_lookup+0x190/0x190 [ 3394.395061] do_vfs_ioctl+0x75a/0xff0 [ 3394.398856] ? lock_acquire+0x170/0x3f0 [ 3394.402821] ? ioctl_preallocate+0x1a0/0x1a0 [ 3394.407210] ? __fget+0x265/0x3e0 [ 3394.410641] ? do_vfs_ioctl+0xff0/0xff0 [ 3394.414593] ? security_file_ioctl+0x83/0xb0 [ 3394.418983] SyS_ioctl+0x7f/0xb0 [ 3394.422327] ? do_vfs_ioctl+0xff0/0xff0 [ 3394.426368] do_syscall_64+0x1d5/0x640 [ 3394.430239] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3394.435403] RIP: 0033:0x7f0bff8e60c9 [ 3394.439087] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:07 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 13) 09:01:07 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r3, 0xee00, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x204000) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x0) (async) syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x204000) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) (async) [ 3394.446769] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3394.454014] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3394.461259] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3394.468504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3394.475754] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:07 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f00000012c0)={0x8, 0x5c, "c408f8e36687457f1fd317a170e0551a59efcbf990ebcbe5ac6758a3a7e3608d917aba2d4949500e1a3a5f2c10ce8623d9baeaf1d4c93b2ce4dda7c5777385213e541b2cf942e31ddf6972f41b0dfc771027cc4c6c2beb3e769728d6"}) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) recvmsg$unix(r1, &(0x7f0000001340)={&(0x7f00000015c0), 0x6e, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/15, 0xf}, {&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/174, 0xae}, {&(0x7f00000011c0)=""/157, 0x9d}], 0x4, &(0x7f0000001500)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x68}, 0x102) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000001480)=@multiplanar_userptr={0xf8, 0x2, 0x4, 0x400, 0x3902, {0x77359400}, {0x2, 0x1, 0x7, 0xaf, 0x80, 0x7, "0dcdf746"}, 0x8001, 0x2, {&(0x7f0000001400)=[{0x7, 0x401, {&(0x7f0000001380)}, 0x100}, {0x446, 0x6, {&(0x7f00000013c0)}, 0xfffffffd}]}, 0x152}) 09:01:07 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) (async, rerun: 32) r2 = getuid() (async, rerun: 32) r3 = getuid() setresuid(r2, r3, 0xee00) (async) setresuid(r3, 0xee00, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3394.575677] FAULT_INJECTION: forcing a failure. [ 3394.575677] name failslab, interval 1, probability 0, space 0, times 0 [ 3394.602490] CPU: 1 PID: 21836 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3394.610391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3394.619740] Call Trace: [ 3394.622325] dump_stack+0x1b2/0x281 09:01:07 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r3, 0xee00, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) getuid() (async) getuid() (async) setresuid(r2, r3, 0xee00) (async) setresuid(r3, 0xee00, 0xffffffffffffffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) [ 3394.625958] should_fail.cold+0x10a/0x149 [ 3394.630117] should_failslab+0xd6/0x130 [ 3394.634093] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3394.638758] bioset_create+0x53/0x750 [ 3394.642557] ? kmem_cache_alloc_node+0x38b/0x410 [ 3394.647313] blk_alloc_queue_node+0xa8/0xb40 [ 3394.651711] blk_mq_init_queue+0x42/0x90 [ 3394.655763] loop_add+0x303/0x830 [ 3394.659201] ? loop_queue_rq+0x280/0x280 [ 3394.663243] ? loop_queue_work+0x21e0/0x21e0 [ 3394.667640] loop_control_ioctl+0x11a/0x3f0 [ 3394.671946] ? loop_lookup+0x190/0x190 [ 3394.675811] ? SyS_write+0x1b7/0x210 [ 3394.679503] ? loop_lookup+0x190/0x190 [ 3394.683371] do_vfs_ioctl+0x75a/0xff0 [ 3394.687171] ? lock_acquire+0x170/0x3f0 [ 3394.691119] ? ioctl_preallocate+0x1a0/0x1a0 [ 3394.695503] ? __fget+0x265/0x3e0 [ 3394.698949] ? do_vfs_ioctl+0xff0/0xff0 [ 3394.702913] ? security_file_ioctl+0x83/0xb0 [ 3394.707306] SyS_ioctl+0x7f/0xb0 [ 3394.710646] ? do_vfs_ioctl+0xff0/0xff0 [ 3394.714600] do_syscall_64+0x1d5/0x640 [ 3394.718470] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 09:01:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:08 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000001880)=""/180, 0xb4}, {&(0x7f0000000000)=""/45, 0x2d}, {&(0x7f0000001940)=""/251, 0xfb}], 0x3, &(0x7f0000001a80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}, {{&(0x7f0000001b40)=@abs, 0x6e, &(0x7f0000001bc0), 0x0, &(0x7f0000001c00)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000001c80)=@abs, 0x6e, &(0x7f0000002e80)=[{&(0x7f0000001d00)=""/21, 0x15}, {&(0x7f0000001d40)=""/235, 0xeb}, {&(0x7f0000001e40)=""/53, 0x35}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x4, &(0x7f0000002ec0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000003100)=[{&(0x7f0000002f00)=""/202, 0xca}, {&(0x7f0000003000)=""/25, 0x19}, {&(0x7f0000003040)=""/186, 0xba}], 0x3}}], 0x4, 0x40000020, &(0x7f0000003240)={0x0, 0x3938700}) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) clock_gettime(0x0, &(0x7f0000001800)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000), 0x0, &(0x7f0000000100)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x68}}, {{&(0x7f0000000180), 0x6e, &(0x7f0000001400)=[{&(0x7f0000000200)=""/64, 0x40}, {&(0x7f0000000240)=""/181, 0xb5}, {&(0x7f0000000300)=""/98, 0x62}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/75, 0x4b}], 0x5, &(0x7f0000001480)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}], 0x158}}, {{&(0x7f0000001600)=@abs, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001680)=""/101, 0x65}], 0x1}}], 0x3, 0x10001, &(0x7f0000001840)={r0, r1+60000000}) 09:01:08 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x204000) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x0) (async) syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x204000) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) (async) 09:01:08 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x8850) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) [ 3394.723643] RIP: 0033:0x7f0bff8e60c9 [ 3394.727336] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3394.735016] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3394.742261] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3394.749508] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3394.756758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3394.764269] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:08 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 14) 09:01:08 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 32) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000001880)=""/180, 0xb4}, {&(0x7f0000000000)=""/45, 0x2d}, {&(0x7f0000001940)=""/251, 0xfb}], 0x3, &(0x7f0000001a80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}, {{&(0x7f0000001b40)=@abs, 0x6e, &(0x7f0000001bc0), 0x0, &(0x7f0000001c00)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000001c80)=@abs, 0x6e, &(0x7f0000002e80)=[{&(0x7f0000001d00)=""/21, 0x15}, {&(0x7f0000001d40)=""/235, 0xeb}, {&(0x7f0000001e40)=""/53, 0x35}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x4, &(0x7f0000002ec0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000003100)=[{&(0x7f0000002f00)=""/202, 0xca}, {&(0x7f0000003000)=""/25, 0x19}, {&(0x7f0000003040)=""/186, 0xba}], 0x3}}], 0x4, 0x40000020, &(0x7f0000003240)={0x0, 0x3938700}) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) clock_gettime(0x0, &(0x7f0000001800)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000), 0x0, &(0x7f0000000100)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x68}}, {{&(0x7f0000000180), 0x6e, &(0x7f0000001400)=[{&(0x7f0000000200)=""/64, 0x40}, {&(0x7f0000000240)=""/181, 0xb5}, {&(0x7f0000000300)=""/98, 0x62}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/75, 0x4b}], 0x5, &(0x7f0000001480)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}], 0x158}}, {{&(0x7f0000001600)=@abs, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001680)=""/101, 0x65}], 0x1}}], 0x3, 0x10001, &(0x7f0000001840)={r0, r1+60000000}) 09:01:08 executing program 1: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f00000012c0)={0x8, 0x5c, "c408f8e36687457f1fd317a170e0551a59efcbf990ebcbe5ac6758a3a7e3608d917aba2d4949500e1a3a5f2c10ce8623d9baeaf1d4c93b2ce4dda7c5777385213e541b2cf942e31ddf6972f41b0dfc771027cc4c6c2beb3e769728d6"}) socket$l2tp6(0xa, 0x2, 0x73) recvmsg$unix(r1, &(0x7f0000001340)={&(0x7f00000015c0), 0x6e, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/15, 0xf}, {&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/174, 0xae}, {&(0x7f00000011c0)=""/157, 0x9d}], 0x4, &(0x7f0000001500)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x68}, 0x102) (async, rerun: 32) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (rerun: 32) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000001480)=@multiplanar_userptr={0xf8, 0x2, 0x4, 0x400, 0x3902, {0x77359400}, {0x2, 0x1, 0x7, 0xaf, 0x80, 0x7, "0dcdf746"}, 0x8001, 0x2, {&(0x7f0000001400)=[{0x7, 0x401, {&(0x7f0000001380)}, 0x100}, {0x446, 0x6, {&(0x7f00000013c0)}, 0xfffffffd}]}, 0x152}) 09:01:08 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x4002) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x11000288) inotify_rm_watch(r0, r2) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000140)) 09:01:08 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000001880)=""/180, 0xb4}, {&(0x7f0000000000)=""/45, 0x2d}, {&(0x7f0000001940)=""/251, 0xfb}], 0x3, &(0x7f0000001a80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}, {{&(0x7f0000001b40)=@abs, 0x6e, &(0x7f0000001bc0), 0x0, &(0x7f0000001c00)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000001c80)=@abs, 0x6e, &(0x7f0000002e80)=[{&(0x7f0000001d00)=""/21, 0x15}, {&(0x7f0000001d40)=""/235, 0xeb}, {&(0x7f0000001e40)=""/53, 0x35}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x4, &(0x7f0000002ec0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000003100)=[{&(0x7f0000002f00)=""/202, 0xca}, {&(0x7f0000003000)=""/25, 0x19}, {&(0x7f0000003040)=""/186, 0xba}], 0x3}}], 0x4, 0x40000020, &(0x7f0000003240)={0x0, 0x3938700}) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) clock_gettime(0x0, &(0x7f0000001800)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000), 0x0, &(0x7f0000000100)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x68}}, {{&(0x7f0000000180), 0x6e, &(0x7f0000001400)=[{&(0x7f0000000200)=""/64, 0x40}, {&(0x7f0000000240)=""/181, 0xb5}, {&(0x7f0000000300)=""/98, 0x62}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/75, 0x4b}], 0x5, &(0x7f0000001480)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}], 0x158}}, {{&(0x7f0000001600)=@abs, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001680)=""/101, 0x65}], 0x1}}], 0x3, 0x10001, &(0x7f0000001840)={r0, r1+60000000}) 09:01:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3394.883533] FAULT_INJECTION: forcing a failure. [ 3394.883533] name failslab, interval 1, probability 0, space 0, times 0 09:01:08 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xdc9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x50}, 0x1, 0x0, 0x0, 0x4c840}, 0x4000000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:08 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xdc9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x50}, 0x1, 0x0, 0x0, 0x4c840}, 0x4000000) (async) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3394.924218] CPU: 1 PID: 21882 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3394.932223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3394.941567] Call Trace: [ 3394.944156] dump_stack+0x1b2/0x281 [ 3394.947782] should_fail.cold+0x10a/0x149 [ 3394.951929] should_failslab+0xd6/0x130 [ 3394.955909] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3394.961009] ? mempool_free+0x1d0/0x1d0 [ 3394.964983] __kmalloc_node+0x38/0x70 [ 3394.968773] mempool_create_node+0xb1/0x3e0 09:01:08 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xdc9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x50}, 0x1, 0x0, 0x0, 0x4c840}, 0x4000000) (async) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3394.973083] ? mempool_kmalloc+0x20/0x20 [ 3394.977151] bioset_create+0x31b/0x750 [ 3394.981035] ? kmem_cache_alloc_node+0x38b/0x410 [ 3394.985795] blk_alloc_queue_node+0xa8/0xb40 [ 3394.990203] blk_mq_init_queue+0x42/0x90 [ 3394.994258] loop_add+0x303/0x830 [ 3394.997693] ? loop_queue_rq+0x280/0x280 [ 3395.001729] ? loop_queue_work+0x21e0/0x21e0 [ 3395.006114] loop_control_ioctl+0x11a/0x3f0 [ 3395.010511] ? loop_lookup+0x190/0x190 [ 3395.014373] ? SyS_write+0x1b7/0x210 [ 3395.018064] ? loop_lookup+0x190/0x190 09:01:08 executing program 2: setresuid(0xee00, 0xee00, 0x0) ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x8000) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1401}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40011) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"9df2bc70dd408521762fc3ea6f320b733da0adf674f2d21673a7fc9973646afe62f05dd334657777bd655112c52ebaf82157710d2fbfe299e625cf6b5280dc4d68e6ae893f3903565a90d72dfa01446127ce92b3b3e0beeae5a5045f2b72591b26dc9246c2b5af379820efe8ac5d2f102135ff10ccfa791dcf670e1ba7974408e4309b42358f0c4e3226fb2c377c80c96d70a249f69c7058b61b30c0ce4679a54491ddac23353f49dd8310b818d63145d31a9c4acc23e024212fb33547e323e63a52c294b8ed5bc2565fe831d36d2ac5c47d90c62f349522d21787db94690b8f47ff72d3654102a9778c6559c5d16e5bce2e9658b8f745dc1233088f74eb7fb0d69bbb0a7b226609848ead7e521babfe5118d9717c80246ad8e9c135088b7f97eb18718c93f4fa4e2a4470a7c9b3c9bdbe7e3ad87f430e76df0651e6583b7bf583fd1dcce50de92d5d47ec13fe5c69c11a25dae07afef476cbdc6066e4614232bd73794ca2d89d507d6e4cfed3687f590ff6f741a47282a5927024a45a399c181484e3168875c995ccb53b5d5d9c5ced78a52c24c8487a0c26ea6ffd7fdd3df3a20256ab64ec9a833a9233fdb0955231eb622cbdbcf6440fd6217c854876344639f5dd4f6376c01c30cf56c3ecb5d012f97b556b122e58dff3cacae542345ae666c33a740decd297b976d8ebec5470f18642ef94c8d6189cabde0f86b3b5cb1537418b622f50ce91471f6ae404d51c4a3cde963968c2c4d190f0db9111be706481c990502f618aebedae7f42261b39d0f4e1cf66f5f96600d5120eed281f77f9722e7ef9a90afb57a73d6cbbce965a66ef6096e595c73f31a7a9f6ed389c8a06b4d796b82000206ba58fc6cf99f0d580d36b69ed3e75ef11f87908c0633d66e24a6cc92ba61ce9400ae382e9d31431be6f869113d56a0fb0bb9c218dde39e9c4d3272f6b5dcc9fd59dfe1769ffc33e64c235b6098c23d680283ef25e6f09b1790e7da8ee736b2ddc2fc60929e37887557c3906a94adc9490833feafd5b30beb44295be8afa1e7c8b06eff60162c2fdc757090c31107e4589b2ea37a63166f9b48363ee13c9071ff620bc97275de4fb9e2fd48b58861075efc0fa55b2c728bc569cfe724e26c3841a307821affe3b8435e1118fc084c5835d02748914ab32ab80cf67b534a8f8a2dd8d3a6bd4be977a4528098736f1eee60d8aafcde1a74e473102ab6a1208fbd1c4c055274909e39adc1f8e481238446af85466c4cf5b1887c09845f7fde239c31a556820d2732dfa25608545496fb592c8465ccadb254e09b4bb8d527720bf986df7a8af1fea47fb04e9ae07aa6952426ab1fe64fccb41f5fcd73b8158e22a7353ef753dc5c6ef63c16f05be4d60f511c04d546a646280909bd95f4f8f1f14726046bf9d4799b71e365a6fb987d2752ba37575ec75df9fb6a0"}) [ 3395.021933] do_vfs_ioctl+0x75a/0xff0 [ 3395.025712] ? lock_acquire+0x170/0x3f0 [ 3395.029668] ? ioctl_preallocate+0x1a0/0x1a0 [ 3395.034073] ? __fget+0x265/0x3e0 [ 3395.037514] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.041465] ? security_file_ioctl+0x83/0xb0 [ 3395.045861] SyS_ioctl+0x7f/0xb0 [ 3395.049220] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.053279] do_syscall_64+0x1d5/0x640 [ 3395.057167] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3395.062348] RIP: 0033:0x7f0bff8e60c9 [ 3395.066051] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:08 executing program 2: setresuid(0xee00, 0xee00, 0x0) ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x8000) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1401}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40011) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"9df2bc70dd408521762fc3ea6f320b733da0adf674f2d21673a7fc9973646afe62f05dd334657777bd655112c52ebaf82157710d2fbfe299e625cf6b5280dc4d68e6ae893f3903565a90d72dfa01446127ce92b3b3e0beeae5a5045f2b72591b26dc9246c2b5af379820efe8ac5d2f102135ff10ccfa791dcf670e1ba7974408e4309b42358f0c4e3226fb2c377c80c96d70a249f69c7058b61b30c0ce4679a54491ddac23353f49dd8310b818d63145d31a9c4acc23e024212fb33547e323e63a52c294b8ed5bc2565fe831d36d2ac5c47d90c62f349522d21787db94690b8f47ff72d3654102a9778c6559c5d16e5bce2e9658b8f745dc1233088f74eb7fb0d69bbb0a7b226609848ead7e521babfe5118d9717c80246ad8e9c135088b7f97eb18718c93f4fa4e2a4470a7c9b3c9bdbe7e3ad87f430e76df0651e6583b7bf583fd1dcce50de92d5d47ec13fe5c69c11a25dae07afef476cbdc6066e4614232bd73794ca2d89d507d6e4cfed3687f590ff6f741a47282a5927024a45a399c181484e3168875c995ccb53b5d5d9c5ced78a52c24c8487a0c26ea6ffd7fdd3df3a20256ab64ec9a833a9233fdb0955231eb622cbdbcf6440fd6217c854876344639f5dd4f6376c01c30cf56c3ecb5d012f97b556b122e58dff3cacae542345ae666c33a740decd297b976d8ebec5470f18642ef94c8d6189cabde0f86b3b5cb1537418b622f50ce91471f6ae404d51c4a3cde963968c2c4d190f0db9111be706481c990502f618aebedae7f42261b39d0f4e1cf66f5f96600d5120eed281f77f9722e7ef9a90afb57a73d6cbbce965a66ef6096e595c73f31a7a9f6ed389c8a06b4d796b82000206ba58fc6cf99f0d580d36b69ed3e75ef11f87908c0633d66e24a6cc92ba61ce9400ae382e9d31431be6f869113d56a0fb0bb9c218dde39e9c4d3272f6b5dcc9fd59dfe1769ffc33e64c235b6098c23d680283ef25e6f09b1790e7da8ee736b2ddc2fc60929e37887557c3906a94adc9490833feafd5b30beb44295be8afa1e7c8b06eff60162c2fdc757090c31107e4589b2ea37a63166f9b48363ee13c9071ff620bc97275de4fb9e2fd48b58861075efc0fa55b2c728bc569cfe724e26c3841a307821affe3b8435e1118fc084c5835d02748914ab32ab80cf67b534a8f8a2dd8d3a6bd4be977a4528098736f1eee60d8aafcde1a74e473102ab6a1208fbd1c4c055274909e39adc1f8e481238446af85466c4cf5b1887c09845f7fde239c31a556820d2732dfa25608545496fb592c8465ccadb254e09b4bb8d527720bf986df7a8af1fea47fb04e9ae07aa6952426ab1fe64fccb41f5fcd73b8158e22a7353ef753dc5c6ef63c16f05be4d60f511c04d546a646280909bd95f4f8f1f14726046bf9d4799b71e365a6fb987d2752ba37575ec75df9fb6a0"}) setresuid(0xee00, 0xee00, 0x0) (async) ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x8000) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1401}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40011) (async) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"9df2bc70dd408521762fc3ea6f320b733da0adf674f2d21673a7fc9973646afe62f05dd334657777bd655112c52ebaf82157710d2fbfe299e625cf6b5280dc4d68e6ae893f3903565a90d72dfa01446127ce92b3b3e0beeae5a5045f2b72591b26dc9246c2b5af379820efe8ac5d2f102135ff10ccfa791dcf670e1ba7974408e4309b42358f0c4e3226fb2c377c80c96d70a249f69c7058b61b30c0ce4679a54491ddac23353f49dd8310b818d63145d31a9c4acc23e024212fb33547e323e63a52c294b8ed5bc2565fe831d36d2ac5c47d90c62f349522d21787db94690b8f47ff72d3654102a9778c6559c5d16e5bce2e9658b8f745dc1233088f74eb7fb0d69bbb0a7b226609848ead7e521babfe5118d9717c80246ad8e9c135088b7f97eb18718c93f4fa4e2a4470a7c9b3c9bdbe7e3ad87f430e76df0651e6583b7bf583fd1dcce50de92d5d47ec13fe5c69c11a25dae07afef476cbdc6066e4614232bd73794ca2d89d507d6e4cfed3687f590ff6f741a47282a5927024a45a399c181484e3168875c995ccb53b5d5d9c5ced78a52c24c8487a0c26ea6ffd7fdd3df3a20256ab64ec9a833a9233fdb0955231eb622cbdbcf6440fd6217c854876344639f5dd4f6376c01c30cf56c3ecb5d012f97b556b122e58dff3cacae542345ae666c33a740decd297b976d8ebec5470f18642ef94c8d6189cabde0f86b3b5cb1537418b622f50ce91471f6ae404d51c4a3cde963968c2c4d190f0db9111be706481c990502f618aebedae7f42261b39d0f4e1cf66f5f96600d5120eed281f77f9722e7ef9a90afb57a73d6cbbce965a66ef6096e595c73f31a7a9f6ed389c8a06b4d796b82000206ba58fc6cf99f0d580d36b69ed3e75ef11f87908c0633d66e24a6cc92ba61ce9400ae382e9d31431be6f869113d56a0fb0bb9c218dde39e9c4d3272f6b5dcc9fd59dfe1769ffc33e64c235b6098c23d680283ef25e6f09b1790e7da8ee736b2ddc2fc60929e37887557c3906a94adc9490833feafd5b30beb44295be8afa1e7c8b06eff60162c2fdc757090c31107e4589b2ea37a63166f9b48363ee13c9071ff620bc97275de4fb9e2fd48b58861075efc0fa55b2c728bc569cfe724e26c3841a307821affe3b8435e1118fc084c5835d02748914ab32ab80cf67b534a8f8a2dd8d3a6bd4be977a4528098736f1eee60d8aafcde1a74e473102ab6a1208fbd1c4c055274909e39adc1f8e481238446af85466c4cf5b1887c09845f7fde239c31a556820d2732dfa25608545496fb592c8465ccadb254e09b4bb8d527720bf986df7a8af1fea47fb04e9ae07aa6952426ab1fe64fccb41f5fcd73b8158e22a7353ef753dc5c6ef63c16f05be4d60f511c04d546a646280909bd95f4f8f1f14726046bf9d4799b71e365a6fb987d2752ba37575ec75df9fb6a0"}) (async) [ 3395.073798] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3395.081043] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3395.088289] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3395.095534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3395.102777] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:08 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:08 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x4002) (async) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x11000288) inotify_rm_watch(r0, r2) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000140)) 09:01:08 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 15) 09:01:08 executing program 1: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x341201) ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) 09:01:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:08 executing program 2: setresuid(0xee00, 0xee00, 0x0) ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x8000) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) socket$l2tp6(0xa, 0x2, 0x73) (async) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1401}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40011) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"9df2bc70dd408521762fc3ea6f320b733da0adf674f2d21673a7fc9973646afe62f05dd334657777bd655112c52ebaf82157710d2fbfe299e625cf6b5280dc4d68e6ae893f3903565a90d72dfa01446127ce92b3b3e0beeae5a5045f2b72591b26dc9246c2b5af379820efe8ac5d2f102135ff10ccfa791dcf670e1ba7974408e4309b42358f0c4e3226fb2c377c80c96d70a249f69c7058b61b30c0ce4679a54491ddac23353f49dd8310b818d63145d31a9c4acc23e024212fb33547e323e63a52c294b8ed5bc2565fe831d36d2ac5c47d90c62f349522d21787db94690b8f47ff72d3654102a9778c6559c5d16e5bce2e9658b8f745dc1233088f74eb7fb0d69bbb0a7b226609848ead7e521babfe5118d9717c80246ad8e9c135088b7f97eb18718c93f4fa4e2a4470a7c9b3c9bdbe7e3ad87f430e76df0651e6583b7bf583fd1dcce50de92d5d47ec13fe5c69c11a25dae07afef476cbdc6066e4614232bd73794ca2d89d507d6e4cfed3687f590ff6f741a47282a5927024a45a399c181484e3168875c995ccb53b5d5d9c5ced78a52c24c8487a0c26ea6ffd7fdd3df3a20256ab64ec9a833a9233fdb0955231eb622cbdbcf6440fd6217c854876344639f5dd4f6376c01c30cf56c3ecb5d012f97b556b122e58dff3cacae542345ae666c33a740decd297b976d8ebec5470f18642ef94c8d6189cabde0f86b3b5cb1537418b622f50ce91471f6ae404d51c4a3cde963968c2c4d190f0db9111be706481c990502f618aebedae7f42261b39d0f4e1cf66f5f96600d5120eed281f77f9722e7ef9a90afb57a73d6cbbce965a66ef6096e595c73f31a7a9f6ed389c8a06b4d796b82000206ba58fc6cf99f0d580d36b69ed3e75ef11f87908c0633d66e24a6cc92ba61ce9400ae382e9d31431be6f869113d56a0fb0bb9c218dde39e9c4d3272f6b5dcc9fd59dfe1769ffc33e64c235b6098c23d680283ef25e6f09b1790e7da8ee736b2ddc2fc60929e37887557c3906a94adc9490833feafd5b30beb44295be8afa1e7c8b06eff60162c2fdc757090c31107e4589b2ea37a63166f9b48363ee13c9071ff620bc97275de4fb9e2fd48b58861075efc0fa55b2c728bc569cfe724e26c3841a307821affe3b8435e1118fc084c5835d02748914ab32ab80cf67b534a8f8a2dd8d3a6bd4be977a4528098736f1eee60d8aafcde1a74e473102ab6a1208fbd1c4c055274909e39adc1f8e481238446af85466c4cf5b1887c09845f7fde239c31a556820d2732dfa25608545496fb592c8465ccadb254e09b4bb8d527720bf986df7a8af1fea47fb04e9ae07aa6952426ab1fe64fccb41f5fcd73b8158e22a7353ef753dc5c6ef63c16f05be4d60f511c04d546a646280909bd95f4f8f1f14726046bf9d4799b71e365a6fb987d2752ba37575ec75df9fb6a0"}) [ 3395.187874] FAULT_INJECTION: forcing a failure. [ 3395.187874] name failslab, interval 1, probability 0, space 0, times 0 09:01:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3395.229018] CPU: 0 PID: 21916 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3395.236919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3395.246265] Call Trace: [ 3395.248850] dump_stack+0x1b2/0x281 [ 3395.252485] should_fail.cold+0x10a/0x149 [ 3395.256621] should_failslab+0xd6/0x130 [ 3395.260591] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3395.265682] ? mempool_free+0x1d0/0x1d0 [ 3395.269636] __kmalloc_node+0x38/0x70 [ 3395.273413] mempool_create_node+0xb1/0x3e0 [ 3395.277721] ? mempool_kmalloc+0x20/0x20 [ 3395.281768] bioset_create+0x31b/0x750 [ 3395.285634] ? kmem_cache_alloc_node+0x38b/0x410 [ 3395.290366] blk_alloc_queue_node+0xa8/0xb40 [ 3395.294760] blk_mq_init_queue+0x42/0x90 [ 3395.299072] loop_add+0x303/0x830 [ 3395.302510] ? loop_queue_rq+0x280/0x280 [ 3395.306545] ? loop_queue_work+0x21e0/0x21e0 [ 3395.310929] loop_control_ioctl+0x11a/0x3f0 [ 3395.315226] ? loop_lookup+0x190/0x190 [ 3395.319096] ? SyS_write+0x1b7/0x210 [ 3395.322794] ? loop_lookup+0x190/0x190 [ 3395.326656] do_vfs_ioctl+0x75a/0xff0 [ 3395.330445] ? lock_acquire+0x170/0x3f0 [ 3395.334393] ? ioctl_preallocate+0x1a0/0x1a0 [ 3395.338791] ? __fget+0x265/0x3e0 [ 3395.342228] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.346179] ? security_file_ioctl+0x83/0xb0 [ 3395.350565] SyS_ioctl+0x7f/0xb0 [ 3395.354089] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.358049] do_syscall_64+0x1d5/0x640 [ 3395.361934] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3395.367103] RIP: 0033:0x7f0bff8e60c9 [ 3395.370803] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:08 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:08 executing program 1: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x341201) (async) ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005) (async) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) 09:01:08 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 16) 09:01:08 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x23, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) [ 3395.378490] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3395.385742] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3395.392984] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3395.400233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3395.407486] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:08 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) inotify_init() (async) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x4002) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x11000288) inotify_rm_watch(r0, r2) (async) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000140)) 09:01:08 executing program 1: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x341201) (async) ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005) (async, rerun: 32) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (rerun: 32) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) 09:01:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3395.516345] FAULT_INJECTION: forcing a failure. [ 3395.516345] name failslab, interval 1, probability 0, space 0, times 0 [ 3395.528600] CPU: 0 PID: 21946 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3395.536489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3395.545841] Call Trace: [ 3395.548427] dump_stack+0x1b2/0x281 [ 3395.552056] should_fail.cold+0x10a/0x149 [ 3395.556194] should_failslab+0xd6/0x130 [ 3395.560152] kmem_cache_alloc+0x28e/0x3c0 [ 3395.564278] ? mempool_free+0x1d0/0x1d0 [ 3395.568409] mempool_create_node+0x2d2/0x3e0 [ 3395.572805] bioset_create+0x31b/0x750 [ 3395.576670] ? kmem_cache_alloc_node+0x38b/0x410 [ 3395.581405] blk_alloc_queue_node+0xa8/0xb40 [ 3395.585792] blk_mq_init_queue+0x42/0x90 [ 3395.589839] loop_add+0x303/0x830 [ 3395.593286] ? loop_queue_rq+0x280/0x280 [ 3395.597342] ? loop_queue_work+0x21e0/0x21e0 [ 3395.601742] loop_control_ioctl+0x11a/0x3f0 [ 3395.606050] ? loop_lookup+0x190/0x190 [ 3395.609930] ? SyS_write+0x1b7/0x210 [ 3395.613636] ? loop_lookup+0x190/0x190 [ 3395.617689] do_vfs_ioctl+0x75a/0xff0 [ 3395.621652] ? lock_acquire+0x170/0x3f0 [ 3395.625602] ? ioctl_preallocate+0x1a0/0x1a0 [ 3395.629995] ? __fget+0x265/0x3e0 [ 3395.633432] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.637393] ? security_file_ioctl+0x83/0xb0 [ 3395.641788] SyS_ioctl+0x7f/0xb0 [ 3395.645136] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.649101] do_syscall_64+0x1d5/0x640 [ 3395.653006] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3395.658173] RIP: 0033:0x7f0bff8e60c9 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) (async) 09:01:09 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 17) 09:01:09 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) 09:01:09 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x23, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x23, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) [ 3395.661864] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3395.669562] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3395.676817] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3395.684066] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3395.691317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3395.698566] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) (async) 09:01:09 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) syz_genetlink_get_family_id$fou(&(0x7f0000000100), r0) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = socket(0x1f, 0x3, 0x80000001) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x3, 0x0, [{0xbd3, 0x0, 0x7fffffffffffffff}, {0x991, 0x0, 0x80000001}, {0x8e0, 0x0, 0x8000000000000001}]}) getpeername$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f0000000080)=0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000200)) 09:01:09 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) (async) 09:01:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3395.828112] FAULT_INJECTION: forcing a failure. [ 3395.828112] name failslab, interval 1, probability 0, space 0, times 0 [ 3395.846812] CPU: 0 PID: 21973 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3395.854708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3395.864044] Call Trace: [ 3395.866613] dump_stack+0x1b2/0x281 [ 3395.870225] should_fail.cold+0x10a/0x149 [ 3395.874349] should_failslab+0xd6/0x130 [ 3395.878304] kmem_cache_alloc+0x28e/0x3c0 [ 3395.882425] ? mempool_free+0x1d0/0x1d0 [ 3395.886560] mempool_create_node+0x2d2/0x3e0 [ 3395.890947] bioset_create+0x31b/0x750 [ 3395.894809] ? kmem_cache_alloc_node+0x38b/0x410 [ 3395.899549] blk_alloc_queue_node+0xa8/0xb40 [ 3395.904035] blk_mq_init_queue+0x42/0x90 [ 3395.908076] loop_add+0x303/0x830 [ 3395.911683] ? loop_queue_rq+0x280/0x280 [ 3395.915719] ? loop_queue_work+0x21e0/0x21e0 [ 3395.920122] loop_control_ioctl+0x11a/0x3f0 [ 3395.924425] ? loop_lookup+0x190/0x190 [ 3395.928291] ? SyS_write+0x1b7/0x210 [ 3395.931981] ? loop_lookup+0x190/0x190 [ 3395.935866] do_vfs_ioctl+0x75a/0xff0 [ 3395.939646] ? lock_acquire+0x170/0x3f0 [ 3395.943598] ? ioctl_preallocate+0x1a0/0x1a0 [ 3395.947982] ? __fget+0x265/0x3e0 [ 3395.951412] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.955363] ? security_file_ioctl+0x83/0xb0 [ 3395.959758] SyS_ioctl+0x7f/0xb0 [ 3395.963104] ? do_vfs_ioctl+0xff0/0xff0 [ 3395.967062] do_syscall_64+0x1d5/0x640 [ 3395.970933] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 09:01:09 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x6083c0, 0x0) socket(0x15, 0x802, 0xfff7fc00) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:09 executing program 2: getuid() getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r1 = getuid() getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r2, r1) getuid() ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:09 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 18) [ 3395.976102] RIP: 0033:0x7f0bff8e60c9 [ 3395.979789] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3395.987480] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3395.994903] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3396.002150] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3396.009394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3396.016639] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:09 executing program 2: getuid() getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r1 = getuid() getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r2, r1) getuid() ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) getuid() (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) (async) setresuid(r0, r2, r1) (async) getuid() (async) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0xffffffffffffffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:09 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), r0) (async, rerun: 64) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (rerun: 64) r1 = socket(0x1f, 0x3, 0x80000001) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x3, 0x0, [{0xbd3, 0x0, 0x7fffffffffffffff}, {0x991, 0x0, 0x80000001}, {0x8e0, 0x0, 0x8000000000000001}]}) getpeername$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f0000000080)=0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000200)) 09:01:09 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x2) 09:01:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:09 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x6083c0, 0x0) socket(0x15, 0x802, 0xfff7fc00) (async, rerun: 64) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (rerun: 64) 09:01:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:09 executing program 2: getuid() (async) getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r1 = getuid() (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r2, r1) getuid() (async) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3396.152315] FAULT_INJECTION: forcing a failure. [ 3396.152315] name failslab, interval 1, probability 0, space 0, times 0 [ 3396.174308] CPU: 0 PID: 22001 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3396.182210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3396.191733] Call Trace: [ 3396.194320] dump_stack+0x1b2/0x281 [ 3396.198216] should_fail.cold+0x10a/0x149 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() setresuid(r0, 0xee00, 0xee01) r1 = getuid() getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000001340)=[{&(0x7f0000000180)=""/173, 0xad}, {&(0x7f0000000240)=""/49, 0x31}, {&(0x7f0000000280)=""/73, 0x49}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/61, 0x3d}], 0x5}, 0x20) setresuid(r1, 0xffffffffffffffff, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = getuid() setresuid(r0, 0xee00, 0xee01) r1 = getuid() (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000001340)=[{&(0x7f0000000180)=""/173, 0xad}, {&(0x7f0000000240)=""/49, 0x31}, {&(0x7f0000000280)=""/73, 0x49}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/61, 0x3d}], 0x5}, 0x20) (async) setresuid(r1, 0xffffffffffffffff, r2) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3396.202359] should_failslab+0xd6/0x130 [ 3396.206338] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3396.211445] ? mempool_free+0x1d0/0x1d0 [ 3396.215424] mempool_create_node+0x76/0x3e0 [ 3396.219750] ? mempool_kmalloc+0x20/0x20 [ 3396.223809] bioset_create+0x506/0x750 [ 3396.227698] ? kmem_cache_alloc_node+0x38b/0x410 [ 3396.232464] blk_alloc_queue_node+0xa8/0xb40 [ 3396.236889] blk_mq_init_queue+0x42/0x90 [ 3396.240956] loop_add+0x303/0x830 [ 3396.244409] ? loop_queue_rq+0x280/0x280 [ 3396.248465] ? loop_queue_work+0x21e0/0x21e0 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = getuid() setresuid(r0, 0xee00, 0xee01) (async) r1 = getuid() (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000001340)=[{&(0x7f0000000180)=""/173, 0xad}, {&(0x7f0000000240)=""/49, 0x31}, {&(0x7f0000000280)=""/73, 0x49}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/61, 0x3d}], 0x5}, 0x20) (async) setresuid(r1, 0xffffffffffffffff, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r1, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r4 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000380)) ioctl$RTC_VL_CLR(r3, 0x7014) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r3) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2f}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r6, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V6={0x14, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) [ 3396.252871] loop_control_ioctl+0x11a/0x3f0 [ 3396.257187] ? loop_lookup+0x190/0x190 [ 3396.261072] ? SyS_write+0x1b7/0x210 [ 3396.264794] ? loop_lookup+0x190/0x190 [ 3396.268686] do_vfs_ioctl+0x75a/0xff0 [ 3396.272488] ? lock_acquire+0x170/0x3f0 [ 3396.276464] ? ioctl_preallocate+0x1a0/0x1a0 [ 3396.280873] ? __fget+0x265/0x3e0 [ 3396.284324] ? do_vfs_ioctl+0xff0/0xff0 [ 3396.288299] ? security_file_ioctl+0x83/0xb0 [ 3396.292711] SyS_ioctl+0x7f/0xb0 [ 3396.296076] ? do_vfs_ioctl+0xff0/0xff0 [ 3396.300052] do_syscall_64+0x1d5/0x640 [ 3396.303954] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3396.309141] RIP: 0033:0x7f0bff8e60c9 [ 3396.312843] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3396.320529] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3396.327778] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3396.335025] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3396.342272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:09 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 19) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 32) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r1, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r4 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000380)) (async) ioctl$RTC_VL_CLR(r3, 0x7014) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r3) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2f}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async, rerun: 64) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r6, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V6={0x14, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) (rerun: 64) [ 3396.349518] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:09 executing program 0: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000100), r0) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) r1 = socket(0x1f, 0x3, 0x80000001) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x3, 0x0, [{0xbd3, 0x0, 0x7fffffffffffffff}, {0x991, 0x0, 0x80000001}, {0x8e0, 0x0, 0x8000000000000001}]}) (async) getpeername$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f0000000080)=0x10) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000200)) 09:01:09 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x37, 0x2000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) socket$l2tp6(0xa, 0x2, 0x73) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_DIRTY_TLB(r4, 0x4010aeaa, &(0x7f0000000080)={0x3, 0x40}) 09:01:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:09 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x6083c0, 0x0) socket(0x15, 0x802, 0xfff7fc00) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r1, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x21}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffffffb}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}]}, 0x60}}, 0x40810) (async, rerun: 64) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r0) (rerun: 64) pipe(&(0x7f0000000200)={0xffffffffffffffff}) (async) r4 = socket(0x6, 0x3, 0xae) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&!]\''}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffff8}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '.#-'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000004}, 0x81) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000380)) (async) ioctl$RTC_VL_CLR(r3, 0x7014) (async) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0), r3) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000680)={&(0x7f0000000580), 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, r6, 0x2, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2f}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) (async) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r6, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V6={0x14, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) [ 3396.465780] FAULT_INJECTION: forcing a failure. [ 3396.465780] name failslab, interval 1, probability 0, space 0, times 0 [ 3396.488924] CPU: 0 PID: 22048 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3396.496833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3396.506186] Call Trace: [ 3396.508773] dump_stack+0x1b2/0x281 09:01:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) 09:01:09 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000080), 0x6, 0x135240) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="d0b00000", @ANYBLOB="9cb081464f8df5fdf49238a6cb4280b44f23c3f5d88adde2f7c6292ca908d072a4d5d353a88860b887f7a410cd07676614a902d3802ed139c8a37dcb124d5b79f10adb4e3a58cd21544adf01be1b947e86c2509f821e25d1211552d371f0ba82d567c141c0a307c52e3fcdb179d8d9fc66746c4a4df6e4f6d7b5e0aaace6da9c0aaa4ff11ac25506213a8ef6770e191609651af812412a5ca5169013e17c2c3d2f649df08704e87883fcf08481d6e27d2ce877ee34ef70d90e2391791fd43a8892c3ddafcb47e43b7f", @ANYRES8=0x0, @ANYRESDEC=r1], 0xd0}}, 0x4) r6 = syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x202000) ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) socket$packet(0x11, 0x3, 0x300) [ 3396.512405] should_fail.cold+0x10a/0x149 [ 3396.516555] should_failslab+0xd6/0x130 [ 3396.520529] kmem_cache_alloc+0x28e/0x3c0 [ 3396.524763] ? mempool_free+0x1d0/0x1d0 [ 3396.528742] mempool_create_node+0x2d2/0x3e0 [ 3396.533159] bioset_create+0x506/0x750 [ 3396.537048] ? kmem_cache_alloc_node+0x38b/0x410 [ 3396.541816] blk_alloc_queue_node+0xa8/0xb40 [ 3396.546226] blk_mq_init_queue+0x42/0x90 [ 3396.550286] loop_add+0x303/0x830 [ 3396.553736] ? loop_queue_rq+0x280/0x280 [ 3396.557800] ? loop_queue_work+0x21e0/0x21e0 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) 09:01:09 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) (async) [ 3396.562211] loop_control_ioctl+0x11a/0x3f0 [ 3396.566530] ? loop_lookup+0x190/0x190 [ 3396.570413] ? SyS_write+0x1b7/0x210 [ 3396.574130] ? loop_lookup+0x190/0x190 [ 3396.578030] do_vfs_ioctl+0x75a/0xff0 [ 3396.581832] ? lock_acquire+0x170/0x3f0 [ 3396.585804] ? ioctl_preallocate+0x1a0/0x1a0 [ 3396.590315] ? __fget+0x265/0x3e0 [ 3396.593770] ? do_vfs_ioctl+0xff0/0xff0 [ 3396.597752] ? security_file_ioctl+0x83/0xb0 [ 3396.602241] SyS_ioctl+0x7f/0xb0 [ 3396.606167] ? do_vfs_ioctl+0xff0/0xff0 [ 3396.610140] do_syscall_64+0x1d5/0x640 [ 3396.614035] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3396.619222] RIP: 0033:0x7f0bff8e60c9 [ 3396.622923] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3396.630620] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3396.637872] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3396.645123] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3396.652374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:10 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 20) 09:01:10 executing program 2: setresuid(0xffffffffffffffff, 0xee01, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) [ 3396.659621] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:10 executing program 2: setresuid(0xffffffffffffffff, 0xee01, 0x0) (async) getresgid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) 09:01:10 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x37, 0x2000) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) socket$l2tp6(0xa, 0x2, 0x73) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_DIRTY_TLB(r4, 0x4010aeaa, &(0x7f0000000080)={0x3, 0x40}) syz_open_dev$loop(&(0x7f0000000040), 0x37, 0x2000) (async) pipe(&(0x7f0000000ac0)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) (async) pipe(&(0x7f0000000000)) (async) ioctl$KVM_DIRTY_TLB(r4, 0x4010aeaa, &(0x7f0000000080)={0x3, 0x40}) (async) 09:01:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x74, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x3}, @acquire_done, @clear_death, @exit_looper, @acquire_done, @increfs_done={0x40106308, 0x2}, @acquire, @free_buffer], 0xe1, 0x0, &(0x7f0000000200)="e7a20d3ec5c3bf5d53230bc2101d6e60a1502d3b42eb246d388e49b52360e44661c771476d67741a2e94c7454f6a7edbe925add8e6db7bc2e81e0a0d94463f9d96d55d0620d79047c6378c30781dfc342e6cc74f3c08cbea22867462aa3d9569cac2a50e54a75e47931e620d9078f77445dca9c62ef6e7ff802fedf0ea8022d0b47d9a2613e135b682cb1a2b0dfa494ea76cb0cc409eb4f7a3bd3ca203b754dec2fdff0d6887e404b8cce1c5cb1e64e0c6887ff969cf7152236dbc44a8f08be41ec114e829f609982479cdcaf3527e4b705f5237634a123498aa38b8031080652e"}) r1 = ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) 09:01:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3396.784904] FAULT_INJECTION: forcing a failure. [ 3396.784904] name failslab, interval 1, probability 0, space 0, times 0 [ 3396.811007] CPU: 0 PID: 22082 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3396.818910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3396.828266] Call Trace: [ 3396.830855] dump_stack+0x1b2/0x281 09:01:10 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000080), 0x6, 0x135240) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="d0b00000", @ANYBLOB="9cb081464f8df5fdf49238a6cb4280b44f23c3f5d88adde2f7c6292ca908d072a4d5d353a88860b887f7a410cd07676614a902d3802ed139c8a37dcb124d5b79f10adb4e3a58cd21544adf01be1b947e86c2509f821e25d1211552d371f0ba82d567c141c0a307c52e3fcdb179d8d9fc66746c4a4df6e4f6d7b5e0aaace6da9c0aaa4ff11ac25506213a8ef6770e191609651af812412a5ca5169013e17c2c3d2f649df08704e87883fcf08481d6e27d2ce877ee34ef70d90e2391791fd43a8892c3ddafcb47e43b7f", @ANYRES8=0x0, @ANYRESDEC=r1], 0xd0}}, 0x4) r6 = syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x202000) ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) socket$packet(0x11, 0x3, 0x300) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) syz_open_dev$mouse(&(0x7f0000000080), 0x6, 0x135240) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="d0b00000", @ANYBLOB="9cb081464f8df5fdf49238a6cb4280b44f23c3f5d88adde2f7c6292ca908d072a4d5d353a88860b887f7a410cd07676614a902d3802ed139c8a37dcb124d5b79f10adb4e3a58cd21544adf01be1b947e86c2509f821e25d1211552d371f0ba82d567c141c0a307c52e3fcdb179d8d9fc66746c4a4df6e4f6d7b5e0aaace6da9c0aaa4ff11ac25506213a8ef6770e191609651af812412a5ca5169013e17c2c3d2f649df08704e87883fcf08481d6e27d2ce877ee34ef70d90e2391791fd43a8892c3ddafcb47e43b7f", @ANYRES8=0x0, @ANYRESDEC=r1], 0xd0}}, 0x4) (async) syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x202000) (async) ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) [ 3396.834486] should_fail.cold+0x10a/0x149 [ 3396.838641] should_failslab+0xd6/0x130 [ 3396.842619] kmem_cache_alloc+0x28e/0x3c0 [ 3396.846766] ? mempool_free+0x1d0/0x1d0 [ 3396.850739] mempool_create_node+0x2d2/0x3e0 [ 3396.855151] bioset_create+0x506/0x750 [ 3396.859038] ? kmem_cache_alloc_node+0x38b/0x410 [ 3396.863792] blk_alloc_queue_node+0xa8/0xb40 [ 3396.868203] blk_mq_init_queue+0x42/0x90 [ 3396.872285] loop_add+0x303/0x830 [ 3396.875717] ? loop_queue_rq+0x280/0x280 [ 3396.879763] ? loop_queue_work+0x21e0/0x21e0 [ 3396.884160] loop_control_ioctl+0x11a/0x3f0 [ 3396.888472] ? loop_lookup+0x190/0x190 [ 3396.892360] ? SyS_write+0x1b7/0x210 [ 3396.896064] ? loop_lookup+0x190/0x190 [ 3396.899946] do_vfs_ioctl+0x75a/0xff0 [ 3396.903740] ? lock_acquire+0x170/0x3f0 [ 3396.907699] ? ioctl_preallocate+0x1a0/0x1a0 [ 3396.912093] ? __fget+0x265/0x3e0 [ 3396.915529] ? do_vfs_ioctl+0xff0/0xff0 [ 3396.919495] ? security_file_ioctl+0x83/0xb0 [ 3396.923900] SyS_ioctl+0x7f/0xb0 [ 3396.927251] ? do_vfs_ioctl+0xff0/0xff0 [ 3396.931201] do_syscall_64+0x1d5/0x640 [ 3396.935076] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3396.940249] RIP: 0033:0x7f0bff8e60c9 [ 3396.943946] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3396.951636] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3396.958982] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3396.966240] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3396.973489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:10 executing program 2: setresuid(0xffffffffffffffff, 0xee01, 0x0) (async) getresgid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs\x00', 0x1ff) 09:01:10 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:10 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x37, 0x2000) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async, rerun: 32) socket$l2tp6(0xa, 0x2, 0x73) (rerun: 32) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KVM_DIRTY_TLB(r4, 0x4010aeaa, &(0x7f0000000080)={0x3, 0x40}) 09:01:10 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 21) [ 3396.980830] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x74, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x3}, @acquire_done, @clear_death, @exit_looper, @acquire_done, @increfs_done={0x40106308, 0x2}, @acquire, @free_buffer], 0xe1, 0x0, &(0x7f0000000200)="e7a20d3ec5c3bf5d53230bc2101d6e60a1502d3b42eb246d388e49b52360e44661c771476d67741a2e94c7454f6a7edbe925add8e6db7bc2e81e0a0d94463f9d96d55d0620d79047c6378c30781dfc342e6cc74f3c08cbea22867462aa3d9569cac2a50e54a75e47931e620d9078f77445dca9c62ef6e7ff802fedf0ea8022d0b47d9a2613e135b682cb1a2b0dfa494ea76cb0cc409eb4f7a3bd3ca203b754dec2fdff0d6887e404b8cce1c5cb1e64e0c6887ff969cf7152236dbc44a8f08be41ec114e829f609982479cdcaf3527e4b705f5237634a123498aa38b8031080652e"}) (async) r1 = ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) 09:01:10 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000080), 0x6, 0x135240) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r3, 0x101}, 0x14}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="d0b00000", @ANYBLOB="9cb081464f8df5fdf49238a6cb4280b44f23c3f5d88adde2f7c6292ca908d072a4d5d353a88860b887f7a410cd07676614a902d3802ed139c8a37dcb124d5b79f10adb4e3a58cd21544adf01be1b947e86c2509f821e25d1211552d371f0ba82d567c141c0a307c52e3fcdb179d8d9fc66746c4a4df6e4f6d7b5e0aaace6da9c0aaa4ff11ac25506213a8ef6770e191609651af812412a5ca5169013e17c2c3d2f649df08704e87883fcf08481d6e27d2ce877ee34ef70d90e2391791fd43a8892c3ddafcb47e43b7f", @ANYRES8=0x0, @ANYRESDEC=r1], 0xd0}}, 0x4) (async) r6 = syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x202000) ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) (async) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) socket$packet(0x11, 0x3, 0x300) 09:01:10 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) r3 = getuid() setresuid(r3, r1, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r4 = getuid() r5 = getuid() setresuid(r4, r5, 0xee00) r6 = getuid() r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x440280, 0x0) ioctl$SNDCTL_TMR_SELECT(r7, 0x40045408) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) setresuid(r1, r5, r6) setresuid(r0, r2, r0) [ 3397.064268] FAULT_INJECTION: forcing a failure. [ 3397.064268] name failslab, interval 1, probability 0, space 0, times 0 [ 3397.093536] CPU: 0 PID: 22116 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3397.101444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3397.110791] Call Trace: 09:01:10 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) r3 = getuid() setresuid(r3, r1, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r4 = getuid() r5 = getuid() setresuid(r4, r5, 0xee00) r6 = getuid() r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x440280, 0x0) ioctl$SNDCTL_TMR_SELECT(r7, 0x40045408) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) setresuid(r1, r5, r6) setresuid(r0, r2, r0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000100)) (async) getuid() (async) setresuid(r3, r1, r1) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() (async) getuid() (async) setresuid(r4, r5, 0xee00) (async) getuid() (async) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x440280, 0x0) (async) ioctl$SNDCTL_TMR_SELECT(r7, 0x40045408) (async) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) (async) setresuid(r1, r5, r6) (async) setresuid(r0, r2, r0) (async) [ 3397.113382] dump_stack+0x1b2/0x281 [ 3397.117009] should_fail.cold+0x10a/0x149 [ 3397.121162] should_failslab+0xd6/0x130 [ 3397.125139] kmem_cache_alloc+0x28e/0x3c0 [ 3397.129283] ? mempool_free+0x1d0/0x1d0 [ 3397.133257] mempool_create_node+0x2d2/0x3e0 [ 3397.137671] bioset_create+0x506/0x750 [ 3397.141562] ? kmem_cache_alloc_node+0x38b/0x410 [ 3397.146321] blk_alloc_queue_node+0xa8/0xb40 [ 3397.150730] blk_mq_init_queue+0x42/0x90 [ 3397.154791] loop_add+0x303/0x830 [ 3397.158242] ? loop_queue_rq+0x280/0x280 09:01:10 executing program 2: getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) r3 = getuid() setresuid(r3, r1, r1) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 64) r4 = getuid() (async, rerun: 64) r5 = getuid() setresuid(r4, r5, 0xee00) (async, rerun: 32) r6 = getuid() (rerun: 32) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x440280, 0x0) ioctl$SNDCTL_TMR_SELECT(r7, 0x40045408) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) (async) setresuid(r1, r5, r6) (async) setresuid(r0, r2, r0) 09:01:10 executing program 2: setresuid(0x0, 0xee01, 0xee01) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000000)=""/63, 0x3f}, {&(0x7f0000000080)=""/162, 0xa2}, {&(0x7f0000000140)=""/166, 0x79}, {&(0x7f0000000200)=""/66, 0x42}, {&(0x7f0000000280)=""/230, 0xe6}, {&(0x7f0000000380)=""/83}, {&(0x7f0000000500)=""/4096}, {&(0x7f0000001500)=""/102}], 0x5, &(0x7f0000000400)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}, 0x100) [ 3397.162295] ? loop_queue_work+0x21e0/0x21e0 [ 3397.166703] loop_control_ioctl+0x11a/0x3f0 [ 3397.171021] ? loop_lookup+0x190/0x190 [ 3397.174910] ? SyS_write+0x1b7/0x210 [ 3397.178623] ? loop_lookup+0x190/0x190 [ 3397.182509] do_vfs_ioctl+0x75a/0xff0 [ 3397.186307] ? lock_acquire+0x170/0x3f0 [ 3397.190452] ? ioctl_preallocate+0x1a0/0x1a0 [ 3397.194856] ? __fget+0x265/0x3e0 [ 3397.198307] ? do_vfs_ioctl+0xff0/0xff0 [ 3397.202278] ? security_file_ioctl+0x83/0xb0 [ 3397.206681] SyS_ioctl+0x7f/0xb0 [ 3397.210048] ? do_vfs_ioctl+0xff0/0xff0 09:01:10 executing program 2: setresuid(0x0, 0xee01, 0xee01) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000000)=""/63, 0x3f}, {&(0x7f0000000080)=""/162, 0xa2}, {&(0x7f0000000140)=""/166, 0x79}, {&(0x7f0000000200)=""/66, 0x42}, {&(0x7f0000000280)=""/230, 0xe6}, {&(0x7f0000000380)=""/83}, {&(0x7f0000000500)=""/4096}, {&(0x7f0000001500)=""/102}], 0x5, &(0x7f0000000400)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}, 0x100) 09:01:10 executing program 2: setresuid(0x0, 0xee01, 0xee01) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000000)=""/63, 0x3f}, {&(0x7f0000000080)=""/162, 0xa2}, {&(0x7f0000000140)=""/166, 0x79}, {&(0x7f0000000200)=""/66, 0x42}, {&(0x7f0000000280)=""/230, 0xe6}, {&(0x7f0000000380)=""/83}, {&(0x7f0000000500)=""/4096}, {&(0x7f0000001500)=""/102}], 0x5, &(0x7f0000000400)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}, 0x100) [ 3397.214023] do_syscall_64+0x1d5/0x640 [ 3397.217922] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3397.223122] RIP: 0033:0x7f0bff8e60c9 [ 3397.226832] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3397.234645] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3397.241905] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3397.249168] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3397.256438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:10 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:10 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 22) 09:01:10 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) getsockname$unix(r0, &(0x7f0000000140), &(0x7f0000000080)=0xffffffffffffff24) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async, rerun: 32) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), 0xffffffffffffffff) (async, rerun: 32) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x74, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x3}, @acquire_done, @clear_death, @exit_looper, @acquire_done, @increfs_done={0x40106308, 0x2}, @acquire, @free_buffer], 0xe1, 0x0, &(0x7f0000000200)="e7a20d3ec5c3bf5d53230bc2101d6e60a1502d3b42eb246d388e49b52360e44661c771476d67741a2e94c7454f6a7edbe925add8e6db7bc2e81e0a0d94463f9d96d55d0620d79047c6378c30781dfc342e6cc74f3c08cbea22867462aa3d9569cac2a50e54a75e47931e620d9078f77445dca9c62ef6e7ff802fedf0ea8022d0b47d9a2613e135b682cb1a2b0dfa494ea76cb0cc409eb4f7a3bd3ca203b754dec2fdff0d6887e404b8cce1c5cb1e64e0c6887ff969cf7152236dbc44a8f08be41ec114e829f609982479cdcaf3527e4b705f5237634a123498aa38b8031080652e"}) r1 = ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) [ 3397.263702] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3397.346394] FAULT_INJECTION: forcing a failure. [ 3397.346394] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3397.347137] audit: type=1800 audit(1672995670.646:28): pid=22182 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.4" name="TIPCv2" dev="sda1" ino=15250 res=0 [ 3397.358218] CPU: 1 PID: 22183 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3397.384670] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3397.394030] Call Trace: [ 3397.396705] dump_stack+0x1b2/0x281 [ 3397.400426] should_fail.cold+0x10a/0x149 [ 3397.404574] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3397.409935] __alloc_pages_nodemask+0x21e/0x2900 [ 3397.414691] ? depot_save_stack+0x10d/0x3f0 [ 3397.419017] ? __lock_acquire+0x5fc/0x3f20 [ 3397.423278] ? blk_mq_init_queue+0x42/0x90 [ 3397.427502] ? loop_add+0x303/0x830 [ 3397.431121] ? loop_control_ioctl+0x11a/0x3f0 [ 3397.435612] ? do_vfs_ioctl+0x75a/0xff0 [ 3397.439581] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 3397.444418] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3397.449782] ? trace_hardirqs_on+0x10/0x10 [ 3397.454025] ? cache_alloc_refill+0x2fa/0x350 [ 3397.458520] cache_grow_begin+0x91/0x700 [ 3397.462583] ? fs_reclaim_release+0xd0/0x110 [ 3397.466988] ? check_preemption_disabled+0x35/0x240 [ 3397.472006] cache_alloc_refill+0x273/0x350 [ 3397.476329] kmem_cache_alloc+0x333/0x3c0 [ 3397.480479] ? mempool_free+0x1d0/0x1d0 [ 3397.484450] mempool_create_node+0x2d2/0x3e0 [ 3397.488870] bioset_create+0x506/0x750 09:01:10 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002f80), 0x2, 0x0) r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r0, r2, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r4 = socket$unix(0x1, 0x5, 0x0) getresuid(&(0x7f0000003b80), &(0x7f0000003bc0), &(0x7f0000003c00)) recvmmsg$unix(r4, &(0x7f0000003a80)=[{{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000001940)=[{&(0x7f0000001640)=""/2, 0x2}, {&(0x7f0000001680)=""/171, 0xab}, {&(0x7f0000001740)=""/211, 0xd3}, {&(0x7f0000001840)=""/230, 0xe6}], 0x4}}, {{&(0x7f0000001980), 0x6e, &(0x7f0000002e00)=[{&(0x7f0000001a00)=""/247, 0xf7}, {&(0x7f0000001b00)=""/64, 0x40}, {&(0x7f0000001b40)=""/32, 0x20}, {&(0x7f0000001b80)=""/127, 0x7f}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/136, 0x88}, {&(0x7f0000002cc0)=""/71, 0x47}, {&(0x7f0000002d40)=""/10, 0xa}, {&(0x7f0000002d80)=""/103, 0x67}], 0x9, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000002f00)=@abs, 0x6e, &(0x7f0000003640)=[{&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/9, 0x9}, {&(0x7f0000003000)=""/152, 0x98}, {&(0x7f00000030c0)=""/201, 0xc9}, {&(0x7f00000031c0)=""/102, 0x66}, {&(0x7f0000003240)=""/217, 0xd9}, {&(0x7f0000003340)=""/130, 0x82}, {&(0x7f0000003400)=""/220, 0xdc}, {&(0x7f0000003500)=""/1, 0x1}, {&(0x7f0000003540)=""/209, 0xd1}], 0xa, &(0x7f0000003700)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000037c0)=""/88, 0x58}, {&(0x7f0000003840)=""/65, 0x41}, {&(0x7f00000038c0)=""/222, 0xde}], 0x3, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}], 0x4, 0x20, 0x0) recvmsg$unix(r4, &(0x7f0000001580)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001480)=[{&(0x7f0000000100)=""/96, 0x60}, {&(0x7f0000000000)=""/24, 0x18}, {&(0x7f0000000180)=""/53, 0x35}, {&(0x7f00000001c0)=""/112, 0x70}, {&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/41, 0x29}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/153, 0x99}], 0x9, &(0x7f0000001540)=[@cred={{0x1c}}], 0x20}, 0x2132) [ 3397.492758] ? kmem_cache_alloc_node+0x38b/0x410 [ 3397.497520] blk_alloc_queue_node+0xa8/0xb40 [ 3397.501938] blk_mq_init_queue+0x42/0x90 [ 3397.505998] loop_add+0x303/0x830 [ 3397.509443] ? loop_queue_rq+0x280/0x280 [ 3397.513496] ? loop_queue_work+0x21e0/0x21e0 [ 3397.517906] loop_control_ioctl+0x11a/0x3f0 [ 3397.522255] ? loop_lookup+0x190/0x190 [ 3397.526136] ? SyS_write+0x1b7/0x210 [ 3397.529846] ? loop_lookup+0x190/0x190 [ 3397.533854] do_vfs_ioctl+0x75a/0xff0 [ 3397.537657] ? lock_acquire+0x170/0x3f0 [ 3397.541635] ? ioctl_preallocate+0x1a0/0x1a0 [ 3397.546045] ? __fget+0x265/0x3e0 [ 3397.549494] ? do_vfs_ioctl+0xff0/0xff0 [ 3397.553475] ? security_file_ioctl+0x83/0xb0 [ 3397.557882] SyS_ioctl+0x7f/0xb0 [ 3397.561247] ? do_vfs_ioctl+0xff0/0xff0 [ 3397.565225] do_syscall_64+0x1d5/0x640 [ 3397.569118] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3397.574294] RIP: 0033:0x7f0bff8e60c9 [ 3397.578022] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3397.585724] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3397.593077] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3397.600565] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3397.607843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3397.615091] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 64) r0 = getuid() (rerun: 64) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002f80), 0x2, 0x0) (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) r2 = getuid() (async) r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r0, r2, 0x0) (async, rerun: 64) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 64) r4 = socket$unix(0x1, 0x5, 0x0) getresuid(&(0x7f0000003b80), &(0x7f0000003bc0), &(0x7f0000003c00)) (async) recvmmsg$unix(r4, &(0x7f0000003a80)=[{{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000001940)=[{&(0x7f0000001640)=""/2, 0x2}, {&(0x7f0000001680)=""/171, 0xab}, {&(0x7f0000001740)=""/211, 0xd3}, {&(0x7f0000001840)=""/230, 0xe6}], 0x4}}, {{&(0x7f0000001980), 0x6e, &(0x7f0000002e00)=[{&(0x7f0000001a00)=""/247, 0xf7}, {&(0x7f0000001b00)=""/64, 0x40}, {&(0x7f0000001b40)=""/32, 0x20}, {&(0x7f0000001b80)=""/127, 0x7f}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/136, 0x88}, {&(0x7f0000002cc0)=""/71, 0x47}, {&(0x7f0000002d40)=""/10, 0xa}, {&(0x7f0000002d80)=""/103, 0x67}], 0x9, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000002f00)=@abs, 0x6e, &(0x7f0000003640)=[{&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/9, 0x9}, {&(0x7f0000003000)=""/152, 0x98}, {&(0x7f00000030c0)=""/201, 0xc9}, {&(0x7f00000031c0)=""/102, 0x66}, {&(0x7f0000003240)=""/217, 0xd9}, {&(0x7f0000003340)=""/130, 0x82}, {&(0x7f0000003400)=""/220, 0xdc}, {&(0x7f0000003500)=""/1, 0x1}, {&(0x7f0000003540)=""/209, 0xd1}], 0xa, &(0x7f0000003700)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000037c0)=""/88, 0x58}, {&(0x7f0000003840)=""/65, 0x41}, {&(0x7f00000038c0)=""/222, 0xde}], 0x3, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}], 0x4, 0x20, 0x0) recvmsg$unix(r4, &(0x7f0000001580)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001480)=[{&(0x7f0000000100)=""/96, 0x60}, {&(0x7f0000000000)=""/24, 0x18}, {&(0x7f0000000180)=""/53, 0x35}, {&(0x7f00000001c0)=""/112, 0x70}, {&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/41, 0x29}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/153, 0x99}], 0x9, &(0x7f0000001540)=[@cred={{0x1c}}], 0x20}, 0x2132) 09:01:11 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 09:01:11 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 23) 09:01:11 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x100000001, 0x8200) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) inotify_rm_watch(r1, 0x0) 09:01:11 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) getsockname$unix(r0, &(0x7f0000000140), &(0x7f0000000080)=0xffffffffffffff24) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:11 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0xc) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002f80), 0x2, 0x0) r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r0, r2, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r4 = socket$unix(0x1, 0x5, 0x0) getresuid(&(0x7f0000003b80), &(0x7f0000003bc0), &(0x7f0000003c00)) recvmmsg$unix(r4, &(0x7f0000003a80)=[{{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000001940)=[{&(0x7f0000001640)=""/2, 0x2}, {&(0x7f0000001680)=""/171, 0xab}, {&(0x7f0000001740)=""/211, 0xd3}, {&(0x7f0000001840)=""/230, 0xe6}], 0x4}}, {{&(0x7f0000001980), 0x6e, &(0x7f0000002e00)=[{&(0x7f0000001a00)=""/247, 0xf7}, {&(0x7f0000001b00)=""/64, 0x40}, {&(0x7f0000001b40)=""/32, 0x20}, {&(0x7f0000001b80)=""/127, 0x7f}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/136, 0x88}, {&(0x7f0000002cc0)=""/71, 0x47}, {&(0x7f0000002d40)=""/10, 0xa}, {&(0x7f0000002d80)=""/103, 0x67}], 0x9, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000002f00)=@abs, 0x6e, &(0x7f0000003640)=[{&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/9, 0x9}, {&(0x7f0000003000)=""/152, 0x98}, {&(0x7f00000030c0)=""/201, 0xc9}, {&(0x7f00000031c0)=""/102, 0x66}, {&(0x7f0000003240)=""/217, 0xd9}, {&(0x7f0000003340)=""/130, 0x82}, {&(0x7f0000003400)=""/220, 0xdc}, {&(0x7f0000003500)=""/1, 0x1}, {&(0x7f0000003540)=""/209, 0xd1}], 0xa, &(0x7f0000003700)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000037c0)=""/88, 0x58}, {&(0x7f0000003840)=""/65, 0x41}, {&(0x7f00000038c0)=""/222, 0xde}], 0x3, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}], 0x4, 0x20, 0x0) recvmsg$unix(r4, &(0x7f0000001580)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001480)=[{&(0x7f0000000100)=""/96, 0x60}, {&(0x7f0000000000)=""/24, 0x18}, {&(0x7f0000000180)=""/53, 0x35}, {&(0x7f00000001c0)=""/112, 0x70}, {&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/41, 0x29}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/153, 0x99}], 0x9, &(0x7f0000001540)=[@cred={{0x1c}}], 0x20}, 0x2132) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002f80), 0x2, 0x0) (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) getuid() (async) getuid() (async) setresuid(r2, r3, 0xee00) (async) setresuid(r0, r2, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) socket$unix(0x1, 0x5, 0x0) (async) getresuid(&(0x7f0000003b80), &(0x7f0000003bc0), &(0x7f0000003c00)) (async) recvmmsg$unix(r4, &(0x7f0000003a80)=[{{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000001940)=[{&(0x7f0000001640)=""/2, 0x2}, {&(0x7f0000001680)=""/171, 0xab}, {&(0x7f0000001740)=""/211, 0xd3}, {&(0x7f0000001840)=""/230, 0xe6}], 0x4}}, {{&(0x7f0000001980), 0x6e, &(0x7f0000002e00)=[{&(0x7f0000001a00)=""/247, 0xf7}, {&(0x7f0000001b00)=""/64, 0x40}, {&(0x7f0000001b40)=""/32, 0x20}, {&(0x7f0000001b80)=""/127, 0x7f}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/136, 0x88}, {&(0x7f0000002cc0)=""/71, 0x47}, {&(0x7f0000002d40)=""/10, 0xa}, {&(0x7f0000002d80)=""/103, 0x67}], 0x9, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000002f00)=@abs, 0x6e, &(0x7f0000003640)=[{&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/9, 0x9}, {&(0x7f0000003000)=""/152, 0x98}, {&(0x7f00000030c0)=""/201, 0xc9}, {&(0x7f00000031c0)=""/102, 0x66}, {&(0x7f0000003240)=""/217, 0xd9}, {&(0x7f0000003340)=""/130, 0x82}, {&(0x7f0000003400)=""/220, 0xdc}, {&(0x7f0000003500)=""/1, 0x1}, {&(0x7f0000003540)=""/209, 0xd1}], 0xa, &(0x7f0000003700)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000037c0)=""/88, 0x58}, {&(0x7f0000003840)=""/65, 0x41}, {&(0x7f00000038c0)=""/222, 0xde}], 0x3, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}], 0x4, 0x20, 0x0) (async) recvmsg$unix(r4, &(0x7f0000001580)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001480)=[{&(0x7f0000000100)=""/96, 0x60}, {&(0x7f0000000000)=""/24, 0x18}, {&(0x7f0000000180)=""/53, 0x35}, {&(0x7f00000001c0)=""/112, 0x70}, {&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/41, 0x29}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/153, 0x99}], 0x9, &(0x7f0000001540)=[@cred={{0x1c}}], 0x20}, 0x2132) (async) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r1, 0xee01, r3) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:11 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x100000001, 0x8200) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) inotify_rm_watch(r1, 0x0) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r1, 0xee01, r3) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) getuid() (async) getuid() (async) setresuid(r2, r3, 0xee00) (async) setresuid(r1, 0xee01, r3) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r1, 0xee01, r3) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) getuid() (async) getuid() (async) setresuid(r2, r3, 0xee00) (async) setresuid(r1, 0xee01, r3) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) [ 3397.869460] FAULT_INJECTION: forcing a failure. [ 3397.869460] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3397.881286] CPU: 0 PID: 22226 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3397.889158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3397.898499] Call Trace: [ 3397.901093] dump_stack+0x1b2/0x281 [ 3397.904725] should_fail.cold+0x10a/0x149 [ 3397.908907] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3397.914281] __alloc_pages_nodemask+0x21e/0x2900 09:01:11 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000140)) r1 = syz_open_dev$mouse(&(0x7f0000000280), 0x25d80000000000, 0x4d0900) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000002c0)=0x200) 09:01:11 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000140)) (async) r1 = syz_open_dev$mouse(&(0x7f0000000280), 0x25d80000000000, 0x4d0900) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000002c0)=0x200) [ 3397.919035] ? depot_save_stack+0x10d/0x3f0 [ 3397.923535] ? __lock_acquire+0x5fc/0x3f20 [ 3397.927771] ? blk_mq_init_queue+0x42/0x90 [ 3397.932014] ? loop_add+0x303/0x830 [ 3397.935638] ? loop_control_ioctl+0x11a/0x3f0 [ 3397.940144] ? do_vfs_ioctl+0x75a/0xff0 [ 3397.944201] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 3397.949037] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3397.954394] ? trace_hardirqs_on+0x10/0x10 [ 3397.958636] ? cache_alloc_refill+0x2fa/0x350 [ 3397.963126] cache_grow_begin+0x91/0x700 [ 3397.967168] ? fs_reclaim_release+0xd0/0x110 [ 3397.971560] ? check_preemption_disabled+0x35/0x240 [ 3397.976556] cache_alloc_refill+0x273/0x350 [ 3397.980869] kmem_cache_alloc+0x333/0x3c0 [ 3397.984998] ? mempool_free+0x1d0/0x1d0 [ 3397.988952] mempool_create_node+0x2d2/0x3e0 [ 3397.993344] bioset_create+0x506/0x750 [ 3397.997211] ? kmem_cache_alloc_node+0x38b/0x410 [ 3398.001947] blk_alloc_queue_node+0xa8/0xb40 [ 3398.006338] blk_mq_init_queue+0x42/0x90 [ 3398.010377] loop_add+0x303/0x830 [ 3398.013808] ? loop_queue_rq+0x280/0x280 [ 3398.017848] ? loop_queue_work+0x21e0/0x21e0 [ 3398.022237] loop_control_ioctl+0x11a/0x3f0 [ 3398.026536] ? loop_lookup+0x190/0x190 [ 3398.030399] ? SyS_write+0x1b7/0x210 [ 3398.034094] ? loop_lookup+0x190/0x190 [ 3398.037965] do_vfs_ioctl+0x75a/0xff0 [ 3398.041845] ? lock_acquire+0x170/0x3f0 [ 3398.045798] ? ioctl_preallocate+0x1a0/0x1a0 [ 3398.050198] ? __fget+0x265/0x3e0 [ 3398.053655] ? do_vfs_ioctl+0xff0/0xff0 [ 3398.057614] ? security_file_ioctl+0x83/0xb0 [ 3398.062016] SyS_ioctl+0x7f/0xb0 [ 3398.065359] ? do_vfs_ioctl+0xff0/0xff0 [ 3398.069317] do_syscall_64+0x1d5/0x640 [ 3398.073186] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3398.078349] RIP: 0033:0x7f0bff8e60c9 [ 3398.082034] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3398.089716] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3398.096964] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3398.104209] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3398.111453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3398.119133] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:11 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) (async, rerun: 64) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 09:01:11 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000140)) r1 = syz_open_dev$mouse(&(0x7f0000000280), 0x25d80000000000, 0x4d0900) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000002c0)=0x200) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000140)) (async) syz_open_dev$mouse(&(0x7f0000000280), 0x25d80000000000, 0x4d0900) (async) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000002c0)=0x200) (async) 09:01:11 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) getsockname$unix(r0, &(0x7f0000000140), &(0x7f0000000080)=0xffffffffffffff24) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) getsockname$unix(r0, &(0x7f0000000140), &(0x7f0000000080)=0xffffffffffffff24) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) 09:01:11 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 24) 09:01:11 executing program 5: setresuid(0x0, 0xee01, 0x0) r0 = getuid() openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002f80), 0x2, 0x0) r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r0, r2, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r4 = socket$unix(0x1, 0x5, 0x0) getresuid(&(0x7f0000003b80), &(0x7f0000003bc0), &(0x7f0000003c00)) recvmmsg$unix(r4, &(0x7f0000003a80)=[{{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000001940)=[{&(0x7f0000001640)=""/2, 0x2}, {&(0x7f0000001680)=""/171, 0xab}, {&(0x7f0000001740)=""/211, 0xd3}, {&(0x7f0000001840)=""/230, 0xe6}], 0x4}}, {{&(0x7f0000001980), 0x6e, &(0x7f0000002e00)=[{&(0x7f0000001a00)=""/247, 0xf7}, {&(0x7f0000001b00)=""/64, 0x40}, {&(0x7f0000001b40)=""/32, 0x20}, {&(0x7f0000001b80)=""/127, 0x7f}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/136, 0x88}, {&(0x7f0000002cc0)=""/71, 0x47}, {&(0x7f0000002d40)=""/10, 0xa}, {&(0x7f0000002d80)=""/103, 0x67}], 0x9, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000002f00)=@abs, 0x6e, &(0x7f0000003640)=[{&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/9, 0x9}, {&(0x7f0000003000)=""/152, 0x98}, {&(0x7f00000030c0)=""/201, 0xc9}, {&(0x7f00000031c0)=""/102, 0x66}, {&(0x7f0000003240)=""/217, 0xd9}, {&(0x7f0000003340)=""/130, 0x82}, {&(0x7f0000003400)=""/220, 0xdc}, {&(0x7f0000003500)=""/1, 0x1}, {&(0x7f0000003540)=""/209, 0xd1}], 0xa, &(0x7f0000003700)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000037c0)=""/88, 0x58}, {&(0x7f0000003840)=""/65, 0x41}, {&(0x7f00000038c0)=""/222, 0xde}], 0x3, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}], 0x4, 0x20, 0x0) recvmsg$unix(r4, &(0x7f0000001580)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001480)=[{&(0x7f0000000100)=""/96, 0x60}, {&(0x7f0000000000)=""/24, 0x18}, {&(0x7f0000000180)=""/53, 0x35}, {&(0x7f00000001c0)=""/112, 0x70}, {&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/41, 0x29}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/153, 0x99}], 0x9, &(0x7f0000001540)=[@cred={{0x1c}}], 0x20}, 0x2132) 09:01:11 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x100000001, 0x8200) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) inotify_rm_watch(r1, 0x0) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000000)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={r2, 0x80000}) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:11 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x88400, 0x0) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={r2, 0x80000}) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:11 executing program 5: setresuid(0x0, 0xee01, 0x0) r0 = getuid() openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002f80), 0x2, 0x0) r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() r3 = getuid() setresuid(r2, r3, 0xee00) setresuid(r0, r2, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r4 = socket$unix(0x1, 0x5, 0x0) getresuid(&(0x7f0000003b80), &(0x7f0000003bc0), &(0x7f0000003c00)) recvmmsg$unix(r4, &(0x7f0000003a80)=[{{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000001940)=[{&(0x7f0000001640)=""/2, 0x2}, {&(0x7f0000001680)=""/171, 0xab}, {&(0x7f0000001740)=""/211, 0xd3}, {&(0x7f0000001840)=""/230, 0xe6}], 0x4}}, {{&(0x7f0000001980), 0x6e, &(0x7f0000002e00)=[{&(0x7f0000001a00)=""/247, 0xf7}, {&(0x7f0000001b00)=""/64, 0x40}, {&(0x7f0000001b40)=""/32, 0x20}, {&(0x7f0000001b80)=""/127, 0x7f}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/136, 0x88}, {&(0x7f0000002cc0)=""/71, 0x47}, {&(0x7f0000002d40)=""/10, 0xa}, {&(0x7f0000002d80)=""/103, 0x67}], 0x9, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000002f00)=@abs, 0x6e, &(0x7f0000003640)=[{&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/9, 0x9}, {&(0x7f0000003000)=""/152, 0x98}, {&(0x7f00000030c0)=""/201, 0xc9}, {&(0x7f00000031c0)=""/102, 0x66}, {&(0x7f0000003240)=""/217, 0xd9}, {&(0x7f0000003340)=""/130, 0x82}, {&(0x7f0000003400)=""/220, 0xdc}, {&(0x7f0000003500)=""/1, 0x1}, {&(0x7f0000003540)=""/209, 0xd1}], 0xa, &(0x7f0000003700)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f00000037c0)=""/88, 0x58}, {&(0x7f0000003840)=""/65, 0x41}, {&(0x7f00000038c0)=""/222, 0xde}], 0x3, &(0x7f0000003a00)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}], 0x4, 0x20, 0x0) recvmsg$unix(r4, &(0x7f0000001580)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001480)=[{&(0x7f0000000100)=""/96, 0x60}, {&(0x7f0000000000)=""/24, 0x18}, {&(0x7f0000000180)=""/53, 0x35}, {&(0x7f00000001c0)=""/112, 0x70}, {&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/41, 0x29}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/153, 0x99}], 0x9, &(0x7f0000001540)=[@cred={{0x1c}}], 0x20}, 0x2132) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000000)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={r2, 0x80000}) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r1}) (async) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={r2, 0x80000}) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:11 executing program 0: getsockname$unix(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000000)=0x6e) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000080)) 09:01:11 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) (async) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) (async) pipe(&(0x7f0000000ac0)) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) (async) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) 09:01:11 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x88400, 0x0) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() setresuid(0xee00, r0, 0xee01) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x187402, 0x0) clock_gettime(0x0, &(0x7f0000001c40)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000001b40)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000280)=[{&(0x7f0000000100)=""/16, 0x10}, {&(0x7f0000000140)=""/19, 0x13}, {&(0x7f0000000180)=""/87, 0x57}, {&(0x7f0000000200)=""/94, 0x5e}], 0x4}}, {{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f0000000480)=[{&(0x7f0000000340)=""/46, 0x2e}, {&(0x7f0000000380)=""/163, 0xa3}, {&(0x7f0000000440)=""/10, 0xa}], 0x3, &(0x7f00000004c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000500)=@abs, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000580)=""/229, 0xe5}], 0x1, &(0x7f00000006c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000700)=""/209, 0xd1}, {&(0x7f0000000800)=""/34, 0x22}, {&(0x7f0000000840)=""/248, 0xf8}, {&(0x7f0000000940)=""/157, 0x9d}, {&(0x7f0000000a00)=""/85, 0x55}, {&(0x7f0000000a80)=""/19, 0x13}, {&(0x7f0000000ac0)=""/4096, 0x1000}], 0x7}}], 0x4, 0x10000, &(0x7f0000001c80)={r2, r3+10000000}) [ 3398.411830] FAULT_INJECTION: forcing a failure. [ 3398.411830] name failslab, interval 1, probability 0, space 0, times 0 [ 3398.431821] CPU: 1 PID: 22300 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3398.439716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3398.449053] Call Trace: [ 3398.451643] dump_stack+0x1b2/0x281 [ 3398.455256] should_fail.cold+0x10a/0x149 [ 3398.459398] should_failslab+0xd6/0x130 [ 3398.463467] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3398.468565] bdi_alloc_node+0x5d/0x2e0 [ 3398.472430] blk_alloc_queue_node+0xe2/0xb40 [ 3398.476815] blk_mq_init_queue+0x42/0x90 [ 3398.480864] loop_add+0x303/0x830 [ 3398.484315] ? loop_queue_rq+0x280/0x280 [ 3398.488379] ? loop_queue_work+0x21e0/0x21e0 [ 3398.492789] loop_control_ioctl+0x11a/0x3f0 [ 3398.497110] ? loop_lookup+0x190/0x190 [ 3398.500978] ? SyS_write+0x1b7/0x210 [ 3398.504680] ? loop_lookup+0x190/0x190 [ 3398.508546] do_vfs_ioctl+0x75a/0xff0 [ 3398.512322] ? lock_acquire+0x170/0x3f0 [ 3398.516272] ? ioctl_preallocate+0x1a0/0x1a0 [ 3398.520660] ? __fget+0x265/0x3e0 [ 3398.526153] ? do_vfs_ioctl+0xff0/0xff0 [ 3398.530111] ? security_file_ioctl+0x83/0xb0 [ 3398.534497] SyS_ioctl+0x7f/0xb0 [ 3398.537838] ? do_vfs_ioctl+0xff0/0xff0 [ 3398.541812] do_syscall_64+0x1d5/0x640 [ 3398.545685] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3398.550872] RIP: 0033:0x7f0bff8e60c9 [ 3398.554562] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:11 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 25) 09:01:11 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 09:01:11 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() setresuid(0xee00, r0, 0xee01) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x187402, 0x0) clock_gettime(0x0, &(0x7f0000001c40)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000001b40)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000280)=[{&(0x7f0000000100)=""/16, 0x10}, {&(0x7f0000000140)=""/19, 0x13}, {&(0x7f0000000180)=""/87, 0x57}, {&(0x7f0000000200)=""/94, 0x5e}], 0x4}}, {{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f0000000480)=[{&(0x7f0000000340)=""/46, 0x2e}, {&(0x7f0000000380)=""/163, 0xa3}, {&(0x7f0000000440)=""/10, 0xa}], 0x3, &(0x7f00000004c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000500)=@abs, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000580)=""/229, 0xe5}], 0x1, &(0x7f00000006c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000700)=""/209, 0xd1}, {&(0x7f0000000800)=""/34, 0x22}, {&(0x7f0000000840)=""/248, 0xf8}, {&(0x7f0000000940)=""/157, 0x9d}, {&(0x7f0000000a00)=""/85, 0x55}, {&(0x7f0000000a80)=""/19, 0x13}, {&(0x7f0000000ac0)=""/4096, 0x1000}], 0x7}}], 0x4, 0x10000, &(0x7f0000001c80)={r2, r3+10000000}) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() (async) setresuid(0xee00, r0, 0xee01) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x187402, 0x0) (async) clock_gettime(0x0, &(0x7f0000001c40)) (async) recvmmsg$unix(r1, &(0x7f0000001b40)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000280)=[{&(0x7f0000000100)=""/16, 0x10}, {&(0x7f0000000140)=""/19, 0x13}, {&(0x7f0000000180)=""/87, 0x57}, {&(0x7f0000000200)=""/94, 0x5e}], 0x4}}, {{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f0000000480)=[{&(0x7f0000000340)=""/46, 0x2e}, {&(0x7f0000000380)=""/163, 0xa3}, {&(0x7f0000000440)=""/10, 0xa}], 0x3, &(0x7f00000004c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000500)=@abs, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000580)=""/229, 0xe5}], 0x1, &(0x7f00000006c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000700)=""/209, 0xd1}, {&(0x7f0000000800)=""/34, 0x22}, {&(0x7f0000000840)=""/248, 0xf8}, {&(0x7f0000000940)=""/157, 0x9d}, {&(0x7f0000000a00)=""/85, 0x55}, {&(0x7f0000000a80)=""/19, 0x13}, {&(0x7f0000000ac0)=""/4096, 0x1000}], 0x7}}], 0x4, 0x10000, &(0x7f0000001c80)={r2, r3+10000000}) (async) 09:01:11 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x88400, 0x0) [ 3398.562257] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3398.569502] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3398.576747] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3398.583998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3398.591251] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:11 executing program 0: getsockname$unix(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000000)=0x6e) (async) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000080)) 09:01:12 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 09:01:12 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0xed, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r2) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r0 = getuid() setresuid(0xee00, r0, 0xee01) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x187402, 0x0) (async) clock_gettime(0x0, &(0x7f0000001c40)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000001b40)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000280)=[{&(0x7f0000000100)=""/16, 0x10}, {&(0x7f0000000140)=""/19, 0x13}, {&(0x7f0000000180)=""/87, 0x57}, {&(0x7f0000000200)=""/94, 0x5e}], 0x4}}, {{&(0x7f00000002c0)=@abs, 0x6e, &(0x7f0000000480)=[{&(0x7f0000000340)=""/46, 0x2e}, {&(0x7f0000000380)=""/163, 0xa3}, {&(0x7f0000000440)=""/10, 0xa}], 0x3, &(0x7f00000004c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000500)=@abs, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000580)=""/229, 0xe5}], 0x1, &(0x7f00000006c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000700)=""/209, 0xd1}, {&(0x7f0000000800)=""/34, 0x22}, {&(0x7f0000000840)=""/248, 0xf8}, {&(0x7f0000000940)=""/157, 0x9d}, {&(0x7f0000000a00)=""/85, 0x55}, {&(0x7f0000000a80)=""/19, 0x13}, {&(0x7f0000000ac0)=""/4096, 0x1000}], 0x7}}], 0x4, 0x10000, &(0x7f0000001c80)={r2, r3+10000000}) [ 3398.747943] FAULT_INJECTION: forcing a failure. [ 3398.747943] name failslab, interval 1, probability 0, space 0, times 0 [ 3398.764669] CPU: 0 PID: 22355 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3398.772574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3398.781928] Call Trace: [ 3398.784514] dump_stack+0x1b2/0x281 [ 3398.788144] should_fail.cold+0x10a/0x149 [ 3398.792293] should_failslab+0xd6/0x130 09:01:12 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(r0, r0, 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:12 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x2) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) 09:01:12 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) (async, rerun: 32) setresuid(r0, r0, 0xffffffffffffffff) (rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:12 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) setresuid(r0, r0, 0xffffffffffffffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3398.796276] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3398.800944] blk_alloc_queue_stats+0x3c/0x100 [ 3398.805435] blk_alloc_queue_node+0x125/0xb40 [ 3398.809931] blk_mq_init_queue+0x42/0x90 [ 3398.813988] loop_add+0x303/0x830 [ 3398.817434] ? loop_queue_rq+0x280/0x280 [ 3398.821490] ? loop_queue_work+0x21e0/0x21e0 [ 3398.825893] loop_control_ioctl+0x11a/0x3f0 [ 3398.830209] ? loop_lookup+0x190/0x190 [ 3398.834088] ? SyS_write+0x1b7/0x210 [ 3398.837798] ? loop_lookup+0x190/0x190 [ 3398.841678] do_vfs_ioctl+0x75a/0xff0 [ 3398.845473] ? lock_acquire+0x170/0x3f0 [ 3398.849448] ? ioctl_preallocate+0x1a0/0x1a0 [ 3398.853853] ? __fget+0x265/0x3e0 [ 3398.857300] ? do_vfs_ioctl+0xff0/0xff0 [ 3398.861265] ? security_file_ioctl+0x83/0xb0 [ 3398.865676] SyS_ioctl+0x7f/0xb0 [ 3398.869032] ? do_vfs_ioctl+0xff0/0xff0 [ 3398.872997] do_syscall_64+0x1d5/0x640 [ 3398.876883] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3398.882053] RIP: 0033:0x7f0bff8e60c9 [ 3398.885739] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3398.893422] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3398.900678] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3398.907934] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3398.915182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3398.922434] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:12 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 26) 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() setresuid(r0, 0xee00, 0xee01) 09:01:12 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) sendto$l2tp(r1, &(0x7f0000000040)="68e03f186342ba131655b2d1b9a26d46d4d36d13aaa64e8ba3", 0x19, 0x8000, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x95}, 0x4000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r2) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 09:01:12 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0xed, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r2) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0xed, 0x0) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r2) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:12 executing program 0: getsockname$unix(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000000)=0x6e) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000080)) getsockname$unix(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000000)=0x6e) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000080)) (async) 09:01:12 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x2) (async, rerun: 32) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) (rerun: 32) [ 3398.956540] Unknown ioctl 19585 09:01:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 1) 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 64) r0 = getuid() (rerun: 64) setresuid(r0, 0xee00, 0xee01) [ 3399.065531] FAULT_INJECTION: forcing a failure. [ 3399.065531] name failslab, interval 1, probability 0, space 0, times 0 [ 3399.073659] FAULT_INJECTION: forcing a failure. [ 3399.073659] name failslab, interval 1, probability 0, space 0, times 0 [ 3399.086998] CPU: 0 PID: 22396 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 [ 3399.095822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3399.105161] Call Trace: [ 3399.107741] dump_stack+0x1b2/0x281 [ 3399.111361] should_fail.cold+0x10a/0x149 [ 3399.115530] should_failslab+0xd6/0x130 [ 3399.119486] kmem_cache_alloc_node+0x263/0x410 [ 3399.124052] __alloc_skb+0x5c/0x510 [ 3399.127669] netlink_sendmsg+0x91e/0xbc0 [ 3399.131728] ? nlmsg_notify+0x1b0/0x1b0 [ 3399.135679] ? kernel_recvmsg+0x210/0x210 [ 3399.139818] ? security_socket_sendmsg+0x83/0xb0 [ 3399.144568] ? nlmsg_notify+0x1b0/0x1b0 [ 3399.148539] sock_sendmsg+0xb5/0x100 [ 3399.152247] ___sys_sendmsg+0x6c8/0x800 [ 3399.153278] Unknown ioctl 19585 [ 3399.156208] ? get_pid_task+0x91/0x130 [ 3399.156220] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 3399.156233] ? lock_downgrade+0x740/0x740 [ 3399.156246] ? __fget+0x23e/0x3e0 [ 3399.156256] ? lock_acquire+0x170/0x3f0 [ 3399.175731] Unknown ioctl 19585 [ 3399.176886] ? lock_downgrade+0x740/0x740 [ 3399.176902] ? __fget+0x265/0x3e0 [ 3399.176916] ? __fdget+0x19b/0x1f0 [ 3399.176927] ? sockfd_lookup_light+0xb2/0x160 [ 3399.176938] __sys_sendmsg+0xa3/0x120 [ 3399.176947] ? SyS_shutdown+0x160/0x160 [ 3399.176959] ? wait_for_completion_io+0x10/0x10 [ 3399.176975] ? SyS_read+0x210/0x210 09:01:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 2) 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() setresuid(r0, 0xee00, 0xee01) 09:01:12 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = socket(0x0, 0x80000, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) (async) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0xed, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r2) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) [ 3399.183253] Unknown ioctl 19585 [ 3399.184199] SyS_sendmsg+0x27/0x40 [ 3399.184208] ? __sys_sendmsg+0x120/0x120 [ 3399.184217] do_syscall_64+0x1d5/0x640 [ 3399.184231] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3399.204594] Unknown ioctl 19585 [ 3399.207516] RIP: 0033:0x7f38870460c9 [ 3399.207522] RSP: 002b:00007f38855b8168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3399.207532] RAX: ffffffffffffffda RBX: 00007f3887165f80 RCX: 00007f38870460c9 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) getuid() ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f0000000000)=0x4) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000140)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) [ 3399.207539] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 3399.207544] RBP: 00007f38855b81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3399.207550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3399.207556] R13: 00007ffdf76a3ddf R14: 00007f38855b8300 R15: 0000000000022000 [ 3399.284580] CPU: 0 PID: 22403 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3399.289638] Unknown ioctl 19585 [ 3399.297342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3399.297346] Call Trace: [ 3399.297369] dump_stack+0x1b2/0x281 [ 3399.297384] should_fail.cold+0x10a/0x149 [ 3399.297397] should_failslab+0xd6/0x130 [ 3399.297418] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3399.300665] Unknown ioctl 19585 [ 3399.310010] blkg_alloc+0x92/0x5c0 [ 3399.310025] blkcg_init_queue+0x23/0x410 [ 3399.310036] blk_alloc_queue_node+0x826/0xb40 [ 3399.310050] blk_mq_init_queue+0x42/0x90 [ 3399.312603] Unknown ioctl 19585 [ 3399.316207] loop_add+0x303/0x830 [ 3399.320354] Unknown ioctl 19585 [ 3399.324276] ? loop_queue_rq+0x280/0x280 [ 3399.329399] Unknown ioctl 19585 [ 3399.332652] ? loop_queue_work+0x21e0/0x21e0 [ 3399.336168] Unknown ioctl 19585 [ 3399.340212] loop_control_ioctl+0x11a/0x3f0 [ 3399.340222] ? loop_lookup+0x190/0x190 [ 3399.340230] ? SyS_write+0x1b7/0x210 [ 3399.340241] ? loop_lookup+0x190/0x190 [ 3399.344713] Unknown ioctl 19585 [ 3399.348752] do_vfs_ioctl+0x75a/0xff0 [ 3399.348765] ? lock_acquire+0x170/0x3f0 [ 3399.348773] ? ioctl_preallocate+0x1a0/0x1a0 [ 3399.348784] ? __fget+0x265/0x3e0 [ 3399.348794] ? do_vfs_ioctl+0xff0/0xff0 09:01:12 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 27) 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs\x00', 0x1ff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) (async) getuid() ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f0000000000)=0x4) (async) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000140)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) [ 3399.348806] ? security_file_ioctl+0x83/0xb0 [ 3399.352056] Unknown ioctl 19585 [ 3399.355489] SyS_ioctl+0x7f/0xb0 [ 3399.358773] Unknown ioctl 19585 [ 3399.362785] ? do_vfs_ioctl+0xff0/0xff0 [ 3399.366046] Unknown ioctl 19585 [ 3399.370507] do_syscall_64+0x1d5/0x640 [ 3399.370524] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3399.370532] RIP: 0033:0x7f0bff8e60c9 [ 3399.370539] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 [ 3399.373816] Unknown ioctl 19585 [ 3399.378110] ORIG_RAX: 0000000000000010 09:01:12 executing program 0: r0 = syz_open_dev$rtc(&(0x7f0000000080), 0x80, 0x8000) ioctl$RTC_WIE_OFF(r0, 0x7010) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0xfff, 0x40002) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) socket$l2tp6(0xa, 0x2, 0x73) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x100302, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000040)) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x19f0) 09:01:12 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) connect$unix(r1, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e24}, 0x6e) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:12 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) getuid() ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f0000000000)=0x4) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000140)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs\x00', 0x1ff) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) (async) getuid() (async) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f0000000000)=0x4) (async) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000140)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) (async) [ 3399.378117] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3399.378122] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3399.378127] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3399.378132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3399.378140] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3399.382002] Unknown ioctl 19585 [ 3399.451200] FAULT_INJECTION: forcing a failure. [ 3399.451200] name failslab, interval 1, probability 0, space 0, times 0 [ 3399.510987] Unknown ioctl 19585 [ 3399.531749] Unknown ioctl 19585 [ 3399.539554] Unknown ioctl 19585 [ 3399.540614] FAULT_INJECTION: forcing a failure. [ 3399.540614] name failslab, interval 1, probability 0, space 0, times 0 [ 3399.554109] Unknown ioctl 19585 [ 3399.554115] Unknown ioctl 19585 [ 3399.554119] Unknown ioctl 19585 [ 3399.554124] Unknown ioctl 19585 [ 3399.554128] Unknown ioctl 19585 [ 3399.554132] Unknown ioctl 19585 [ 3399.554136] Unknown ioctl 19585 [ 3399.554140] Unknown ioctl 19585 [ 3399.554145] Unknown ioctl 19585 [ 3399.554150] Unknown ioctl 19585 [ 3399.554155] Unknown ioctl 19585 [ 3399.554159] Unknown ioctl 19585 [ 3399.554164] Unknown ioctl 19585 [ 3399.554168] Unknown ioctl 19585 [ 3399.600583] CPU: 0 PID: 22427 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 [ 3399.608547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3399.617899] Call Trace: [ 3399.620488] dump_stack+0x1b2/0x281 [ 3399.624112] should_fail.cold+0x10a/0x149 [ 3399.628253] should_failslab+0xd6/0x130 [ 3399.632224] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3399.637573] __kmalloc_node_track_caller+0x38/0x70 [ 3399.642489] __alloc_skb+0x96/0x510 [ 3399.646101] netlink_sendmsg+0x91e/0xbc0 [ 3399.650151] ? nlmsg_notify+0x1b0/0x1b0 [ 3399.654197] ? kernel_recvmsg+0x210/0x210 [ 3399.658329] ? security_socket_sendmsg+0x83/0xb0 [ 3399.663067] ? nlmsg_notify+0x1b0/0x1b0 [ 3399.667028] sock_sendmsg+0xb5/0x100 [ 3399.670736] ___sys_sendmsg+0x6c8/0x800 [ 3399.674767] ? get_pid_task+0x91/0x130 [ 3399.678644] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 3399.683383] ? lock_downgrade+0x740/0x740 [ 3399.687520] ? __fget+0x23e/0x3e0 [ 3399.690965] ? lock_acquire+0x170/0x3f0 [ 3399.694924] ? lock_downgrade+0x740/0x740 [ 3399.699055] ? __fget+0x265/0x3e0 [ 3399.702492] ? __fdget+0x19b/0x1f0 [ 3399.706016] ? sockfd_lookup_light+0xb2/0x160 [ 3399.710498] __sys_sendmsg+0xa3/0x120 [ 3399.714287] ? SyS_shutdown+0x160/0x160 [ 3399.718246] ? wait_for_completion_io+0x10/0x10 [ 3399.722909] ? SyS_read+0x210/0x210 [ 3399.726521] SyS_sendmsg+0x27/0x40 [ 3399.730048] ? __sys_sendmsg+0x120/0x120 [ 3399.731715] Unknown ioctl -2147192813 [ 3399.734103] do_syscall_64+0x1d5/0x640 [ 3399.734121] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3399.734130] RIP: 0033:0x7f38870460c9 [ 3399.734135] RSP: 002b:00007f38855b8168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3399.734146] RAX: ffffffffffffffda RBX: 00007f3887165f80 RCX: 00007f38870460c9 [ 3399.734151] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 3399.734156] RBP: 00007f38855b81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3399.734164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3399.746166] Unknown ioctl 43777 [ 3399.747097] R13: 00007ffdf76a3ddf R14: 00007f38855b8300 R15: 0000000000022000 [ 3399.787093] CPU: 0 PID: 22439 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3399.806173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3399.815503] Call Trace: [ 3399.818070] dump_stack+0x1b2/0x281 [ 3399.821675] should_fail.cold+0x10a/0x149 [ 3399.825806] should_failslab+0xd6/0x130 [ 3399.829766] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3399.834947] blkg_alloc+0x92/0x5c0 [ 3399.838468] blkcg_init_queue+0x23/0x410 [ 3399.842507] blk_alloc_queue_node+0x826/0xb40 [ 3399.846980] blk_mq_init_queue+0x42/0x90 [ 3399.851016] loop_add+0x303/0x830 [ 3399.854705] ? loop_queue_rq+0x280/0x280 [ 3399.858741] ? loop_queue_work+0x21e0/0x21e0 [ 3399.863146] loop_control_ioctl+0x11a/0x3f0 [ 3399.867444] ? loop_lookup+0x190/0x190 [ 3399.871305] ? SyS_write+0x1b7/0x210 [ 3399.874996] ? loop_lookup+0x190/0x190 [ 3399.878860] do_vfs_ioctl+0x75a/0xff0 [ 3399.882637] ? lock_acquire+0x170/0x3f0 [ 3399.886587] ? ioctl_preallocate+0x1a0/0x1a0 [ 3399.890975] ? __fget+0x265/0x3e0 [ 3399.894412] ? do_vfs_ioctl+0xff0/0xff0 [ 3399.898366] ? security_file_ioctl+0x83/0xb0 [ 3399.902782] SyS_ioctl+0x7f/0xb0 [ 3399.906124] ? do_vfs_ioctl+0xff0/0xff0 [ 3399.910079] do_syscall_64+0x1d5/0x640 [ 3399.913947] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3399.919113] RIP: 0033:0x7f0bff8e60c9 [ 3399.922798] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:13 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x2) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x2) (async) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f0000000000)) (async) 09:01:13 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(0x0, r0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 3) 09:01:13 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) connect$unix(r1, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e24}, 0x6e) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:13 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 28) 09:01:13 executing program 0: r0 = syz_open_dev$rtc(&(0x7f0000000080), 0x80, 0x8000) ioctl$RTC_WIE_OFF(r0, 0x7010) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0xfff, 0x40002) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) socket$l2tp6(0xa, 0x2, 0x73) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x100302, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000040)) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x19f0) syz_open_dev$rtc(&(0x7f0000000080), 0x80, 0x8000) (async) ioctl$RTC_WIE_OFF(r0, 0x7010) (async) syz_open_dev$loop(&(0x7f00000000c0), 0xfff, 0x40002) (async) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x100302, 0x0) (async) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000040)) (async) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x19f0) (async) [ 3399.930490] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3399.937735] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3399.945009] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3399.952255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3399.959504] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3400.046131] FAULT_INJECTION: forcing a failure. [ 3400.046131] name failslab, interval 1, probability 0, space 0, times 0 [ 3400.069744] Unknown ioctl -2147192813 [ 3400.078170] Unknown ioctl 43777 [ 3400.085468] CPU: 0 PID: 22463 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 09:01:13 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) (async) setresuid(0x0, r0, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:13 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(0x0, r0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) [ 3400.093392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3400.102740] Call Trace: [ 3400.105333] dump_stack+0x1b2/0x281 [ 3400.108960] should_fail.cold+0x10a/0x149 [ 3400.113113] should_failslab+0xd6/0x130 [ 3400.117084] kmem_cache_alloc+0x40/0x3c0 [ 3400.121153] skb_clone+0x126/0x9a0 [ 3400.124692] netlink_deliver_tap+0x67e/0x860 [ 3400.129096] netlink_unicast+0x485/0x610 [ 3400.133153] ? netlink_sendskb+0xd0/0xd0 [ 3400.137212] ? __check_object_size+0x179/0x230 [ 3400.141795] netlink_sendmsg+0x648/0xbc0 09:01:13 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000000)) setresuid(0x0, 0xee00, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2\x00', 0x1ff) [ 3400.145855] ? nlmsg_notify+0x1b0/0x1b0 [ 3400.149820] ? kernel_recvmsg+0x210/0x210 [ 3400.153964] ? security_socket_sendmsg+0x83/0xb0 [ 3400.158717] ? nlmsg_notify+0x1b0/0x1b0 [ 3400.162685] sock_sendmsg+0xb5/0x100 [ 3400.166404] ___sys_sendmsg+0x6c8/0x800 [ 3400.170375] ? get_pid_task+0x91/0x130 [ 3400.174268] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 3400.179032] ? lock_downgrade+0x740/0x740 [ 3400.183184] ? __fget+0x23e/0x3e0 [ 3400.186631] ? lock_acquire+0x170/0x3f0 [ 3400.190599] ? lock_downgrade+0x740/0x740 09:01:13 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000000)) (async) setresuid(0x0, 0xee00, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2\x00', 0x1ff) [ 3400.194743] ? __fget+0x265/0x3e0 [ 3400.198287] ? __fdget+0x19b/0x1f0 [ 3400.201820] ? sockfd_lookup_light+0xb2/0x160 [ 3400.206309] __sys_sendmsg+0xa3/0x120 [ 3400.210109] ? SyS_shutdown+0x160/0x160 [ 3400.214078] ? wait_for_completion_io+0x10/0x10 [ 3400.218767] ? SyS_read+0x210/0x210 [ 3400.222395] SyS_sendmsg+0x27/0x40 [ 3400.225931] ? __sys_sendmsg+0x120/0x120 [ 3400.229984] do_syscall_64+0x1d5/0x640 [ 3400.233874] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3400.239059] RIP: 0033:0x7f38870460c9 09:01:13 executing program 2: pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000000)) setresuid(0x0, 0xee00, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2\x00', 0x1ff) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000000)) (async) setresuid(0x0, 0xee00, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2\x00', 0x1ff) (async) 09:01:13 executing program 2: r0 = getuid() setresuid(0x0, 0xee01, r0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r1, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3400.242767] RSP: 002b:00007f38855b8168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3400.250466] RAX: ffffffffffffffda RBX: 00007f3887165f80 RCX: 00007f38870460c9 [ 3400.257729] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 3400.265008] RBP: 00007f38855b81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3400.272273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3400.279540] R13: 00007ffdf76a3ddf R14: 00007f38855b8300 R15: 0000000000022000 09:01:13 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48084}, 0x4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x19, 0x31, 0x4, 0x1b, 0x1, 0xfff, 0x2, 0x5f, 0x1}}) 09:01:13 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) connect$unix(r1, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e24}, 0x6e) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) connect$unix(r1, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e24}, 0x6e) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:13 executing program 0: r0 = syz_open_dev$rtc(&(0x7f0000000080), 0x80, 0x8000) ioctl$RTC_WIE_OFF(r0, 0x7010) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0xfff, 0x40002) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) socket$l2tp6(0xa, 0x2, 0x73) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x100302, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000040)) (async) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x19f0) 09:01:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 4) [ 3400.329280] FAULT_INJECTION: forcing a failure. [ 3400.329280] name failslab, interval 1, probability 0, space 0, times 0 [ 3400.346452] CPU: 0 PID: 22507 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3400.354345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3400.363688] Call Trace: [ 3400.366258] dump_stack+0x1b2/0x281 [ 3400.369871] should_fail.cold+0x10a/0x149 [ 3400.374002] should_failslab+0xd6/0x130 [ 3400.377960] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3400.383044] throtl_pd_alloc+0x59/0x990 [ 3400.386994] ? throtl_add_bio_tg+0x1e0/0x1e0 [ 3400.391380] blkcg_activate_policy+0x115/0x5c0 [ 3400.395943] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 3400.400938] blk_throtl_init+0x408/0x590 [ 3400.404982] blkcg_init_queue+0x18f/0x410 [ 3400.409107] blk_alloc_queue_node+0x826/0xb40 [ 3400.413601] blk_mq_init_queue+0x42/0x90 [ 3400.416159] Unknown ioctl -2147192813 [ 3400.417657] loop_add+0x303/0x830 [ 3400.417668] ? loop_queue_rq+0x280/0x280 [ 3400.417675] ? loop_queue_work+0x21e0/0x21e0 [ 3400.417688] loop_control_ioctl+0x11a/0x3f0 [ 3400.417696] ? loop_lookup+0x190/0x190 [ 3400.417705] ? SyS_write+0x1b7/0x210 [ 3400.417716] ? loop_lookup+0x190/0x190 [ 3400.417726] do_vfs_ioctl+0x75a/0xff0 [ 3400.421612] Unknown ioctl 43777 [ 3400.424963] ? lock_acquire+0x170/0x3f0 [ 3400.424974] ? ioctl_preallocate+0x1a0/0x1a0 [ 3400.424986] ? __fget+0x265/0x3e0 [ 3400.468252] ? do_vfs_ioctl+0xff0/0xff0 [ 3400.472210] ? security_file_ioctl+0x83/0xb0 [ 3400.476595] SyS_ioctl+0x7f/0xb0 [ 3400.479959] ? do_vfs_ioctl+0xff0/0xff0 [ 3400.483917] do_syscall_64+0x1d5/0x640 [ 3400.487790] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3400.492957] RIP: 0033:0x7f0bff8e60c9 [ 3400.496645] RSP: 002b:00007f0bfde37168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3400.504330] RAX: ffffffffffffffda RBX: 00007f0bffa06050 RCX: 00007f0bff8e60c9 [ 3400.511753] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3400.519001] RBP: 00007f0bfde371d0 R08: 0000000000000000 R09: 0000000000000000 09:01:13 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 29) 09:01:13 executing program 2: r0 = getuid() setresuid(0x0, 0xee01, r0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r1, r2) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:13 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x602602, 0x0) socket(0x1, 0x1, 0x80b) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x802, 0x0) r2 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) write$yama_ptrace_scope(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001440)={0xa0, 0x0, &(0x7f0000000380)=[@release={0x40046306, 0x1}, @clear_death, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/211, 0xd3, 0x0, 0x18}, @ptr={0x70742a85, 0x1, &(0x7f0000001480)=""/83, 0x53, 0x2, 0x7ff}, @fda={0x66646185, 0x3, 0x0, 0x33}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x100b, 0x1}, @fda={0x66646185, 0x7, 0x0, 0x34}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000001500)={0x0, 0x18, 0x38}}}], 0x1000, 0x0, &(0x7f0000000440)="f9ddce71c2ef4f7aaeb8b639bebfdf0567eb1b9e3dd32d2cc93de3b08ffc4f5745ca611f30a8951fb6d9a82b17ab91721aea9dceed19e50ddf5119109dfdfaa6cd8575b6c612ae8a1f3adbbfdf63128e47937c5e009d0bd8c37517908549a52a15e6ffb5f31b5b003a643897643e19051558afa21079a62f970ea73b643ce1af48f19b30983264283abaef6f688b7fb66d7f27f4cd0ef93cab26e94a044c614539567fe9ee22c16942add9c1c3546fba41270fb49c781b69d32122393bea5a0b7b86e5623af87025388c97a7f4ef44e86aad2e4c46341cd5684b5b2397c4f6b8277109f1b4d5820e69bb43848fa7e1189a9eb79f655ba0b1b63523db661228a13fc222c0b75f4fccc58d0a4e7dcacef98fa9817d2af1ab71cf140ec8b4d59fd87331536c5a4eff9421b51d87b2b0d1ddc21b9697199013c26bdf0453e3eca670b3875dc771e9f62d1b61e7c8a7dda023eea16840c00dd2c0b797169f2447a999dcc39519711728fc3c29f87ad780ffc0e3c30c63d6091c54e56062d86f6ecd588fd8b3ba315c3bd61a52b72773080f7c84d50f77e5d166df46e16cabd1508854f618c2b28418ceee8343e2c8a7d779e232f0f0bbb44d3032a0243601a915a2f6b95d71e63f370b3e4664f4d201276b3dc0237a96c340978979233ce8ba5f825adc4afc983ff41f77ba902571cc810c277d2da9053e58d786e4c060c75c27fa1b817563f77c279155ecdc87618e4b36413afdc8b4bf9a511ce628b70f6ec22896c829c2acdbdc167d5fd084ec3b1fbac30b8e934aa473e8909ac83bca0670c7cb156d9371d7f2be60dc2e0a218b7a95e46e2c83d03050682af21f123badd2f09900bd132a2f108880796dd1d45e044d1185f761d2ed9e43f23a1fd9877627d7448b44e33c0c6c29d32e8e8b798401e0e8422da7a1d416691b27346355246eafdd02fa8cd689945c861a22a04c0fe4ded0e77276c3508ff091639ad468114c018fc932a5e4d60f4e6b97d8bb9a3fc21bb84f6900815fe666a34ceda0590ee3d6b32e5b5412c82869d1446992a5733a16f0d9033ec9a63930cb9da3db2abe2ec6467efc16972700c11a33bd81241bcce13c4290290070989064760e15c24be856b1c81f5f02ad2fbf89a97dcfacfeb2aa9244f77509e1f7b27ec9baf41bb031d8e135157f48202782514cde4cca71e8896169cc0cf9cd78a47595000a7133b41cd5a790ed3a307f1d2db8fc6d8f067bcb8042823a3d1cdb825795873685aafedcc143d864bb20ed3264a757a78b3748049a5f21dcfccc1f2e94b332e16e662a729470a0f4188aca44857c0ffd0a32c4919e7e6a3a4de35b55141d30c2c593b97dba947d8ce8da798c2dbb5b14ace8100de452d5967ceef36434cbf9b02a080d1bab90032331dd9bbc81f6031513621e5f5b883ed339e42f07b0b3b11464f5fc8e0d089cb6c2e17427b40e7f6c83013711f9366eb8cbe55832613e6abe2b39bec29b99b47769377bd6d7c96be117e9b62617d543b5234344b939ade6668a0c810c86dc408fb4fe016e6c0fef2cc19cbd59550ede1abea0f8ad6611aca5a9f26c030bd7cdc488205ecd90521d6198bc69f656d26f45acd5819c03566f0cdb512e1194a9042e151a3259e128197371a564c2e74fd723092e097dcd2de322adfcfe131907f393b4ef8b7f0bc3bd536de9fc0fe0c1f4712469f2f537a48f4aaadd235e925b91956a5e6bdcce82ee0521c9e0ca03b2f54f7a871e6bc74d94e28bd3c05599293612a2e817c792c25673352be9f65dd837a4f74847b6e4b659583a8111fc625515145cce41b522d253fd2448d4cd76807f600652d2068a4ee3e77dcf02c7da2bdc528eda34c3c939f904feee557612059a36d64f9e1f22c46ac4f0fac069547229557d4bac16fea23f8bd9c42371e68a1a0936ee2fcc0c10eb19eaef6303d852257642be6112e12493d1c175d4a8469b00cd3420b0c3449f67dfac81131bbf753172f2dc950b4680261c0b8dfcc0558b1f0d100dccb1229c1c3524a37d45f7fcce1f4430b15acaac7aad949686607de513ec602c9301150bce2e862205d1b670ae2fa1a48620ad34111e5026a8a3a01595cfb145e0c37156b874b01fa5a10edc16b17067ba82131ef42019d3d75ab4bb0632dfc216ac7ac4a4c5d95f9d7e67fecc502ec28dcc33f3b3648bff13b07acc9062f8b82355d252941990ddc68f61f30c673a80deffc2e5628fd08edde71ab0c25940823f688fc3ea240d0c0900071529cc14720c201526da7d260e5a1cf29345633aac535cc9afb6a381d653307a8340ddebab15e3db8b7c6e1a22015c3a460af05c9af1c3514be3bf0a7f387042fa126a05b0f7878daf807fc962a82af0022a55b53796ceb82ce7b0298c9a829d951bd40b117c39c011c8ddd2e2fdd354d6178dbf3cdd176c775123a0009991374aaa9c0cbffa2453326d67eaf0195ba326b65b0423418a761d40ed707e383d4da443abe9e49ec2eb8bc92a1914e18df0e5001fe079e587b0f641a11d18e6f161a84eba226b422170371812afd66e7d3f5b6ff1b921b8c470c23e5e41ae5da60b0c62fac16494f2d7c158b6e271a8c941574387ee58eca54d56c7ed6291e3761150c264415849d12be6361f50f60366d83fb921145b29f0d66e7f14ff380abc7207a7a2327b61752f1dacdbec56a4c9b0f9e3472fbdb19f31be73fa3d1de9db88179999ca905ebbfc4a4fe2ad60f54a75dc30e9baa4cf194cf773707a8accfd9d1a58a8a0614d9470f8b8c0744cfe800db89f51c23add8849ab2ab3cd35e6d525794c594b214ebe3c0048129974a8e02d3817debdbd833ec4ba121ae8fe0bd9d1d599a8389a2e870b9c394c7b6d3f8dc86db254b9b695c15f07c0eecd975ad88abf04445091d4b0332aa4d538a37964d77594afe7b56c572d3e659f35b4a725eeee8a1196404265f982e18e84ea52fdbba1db1440a2270648903508d58812b6a65808b4efa8dbffc44177e1c03aeb97311782a2275805c396cfab107fed746a65a58fe8e3a2275ce389d20a1313e88589026a9f5a56d134c8c4363db8b2e505bdbd601dc70ebd7484934d44881b05038b4a70da1b0af8ed7ee76f5ceeb660fd5f9fa8445cc6c4e44027759a7fd4a6be90e37e9254f4be1743279b3997c77c78034d958afcd71db914c61945d5ce91211b3069a8f33ce49f0a1fbf5391d2e4eada40a31d8eb44510ee453adb7d9028fcdbfc2b4ee0ce69e7b3f24c62d815f0dd23e441bd6535ef55d328e592d1cb6aaeaea14cc4812da84127854e45d5d135b1ae8111a16fe1dabf899aa5508f4f104b4ca54a8f34d7cab882396f520dbd27a0a2ff4dc5f8df64139112ba4f1db715039ba778e82ed4308bf605e395faa72b4d4080d2a40d697975fbafe25be6ee6bb4c5d49748099b67981f21e814b971b9f491ebfd2b03ee48a9f6217a19ae617c275d00444f76b3b30aca4c81b0d56b9116534eafb23265db24d4b507bf53f11d393c19c0bda085b69a53bf3b75d28a9118c53785b00eb66aed34f002878f3b912d72e795c547ae764e7788c05762bfa91a38b5c9343952f8e1ea59016db3871c5ac70b295dc15ece920862b5b465498dc61633a4ccb02d63d9df6bb3c1aed796fd95c23503f843be3901fedbb2c7b7a09028fbfb98e5cfece5426f98e7ba7eb262eac55fce5ff2209e7a9bb48e4f9b28e121e54d8229635ed555bc86eabf4d4bf00d5453067c8da0c31a520188e67890a0c3a0ebc87a028564b59bdb1b39730b02c3d430b95a79c0a7b4614e170f8e135aa350e62d884b01601a01b06cfe0c6e75966dff3dcd2bf591392c294fa1c017227f66b433f852b3784b422e42eac103c32ed6f0d60a372972f380c686adc85b82decc01a45fc7e19a2326ca4f88bb101a1b2fd7df06dfeb33b16b2dbb3a75414eead2055cd30522fbe2c5cc487267c23564a98fe53e323f76c85ab6f02313857cf97050852385430eb97efc35880c071ea995c6f9c06f45a7017aa54a892b4f9a4a2a4d32db16fcd3ff1a43b18159d8bcc091a4efd5c96ff60402c22ab99f698ca28de3ee83a4030ee3b477311f789703dd4c342e51934a12c7a21e5e00b02a6ed44e12b93c6ce373eb00e4d25351273e4110646df62344acea03e1b0ed6e24ba83d4759f9a34384a4159b2de6620d960ffede01a045304849a8a53be2925ad1174e332f81c313e86a4f47b4706b6c4b3c9f84fe20829ddaa7e2fd729ea150f4344007bfe3f84ad2421d6dbad75187c215775140a3fc66001bc0b3a83c042b0a106185adbce4f88e1542b84dc1cb69c9e4e2e227b10870fed486375a2b3047e1683135cc14a1a56142cd01909e1414dc196ba2df00bd91f96cdf4f3cfc01a24cc552f45d4b02b5c7a97040235851a58c281e0f095e05265735bbf72a5702a73117189c6dd41cdaa5a50066f75b1d6f93098cceaa44c51370c709968dd7bad3eae378218e45cb46c297e7a63cd3696adbf3109520bfcfba5e472c7b2ac89f3e14f3a3da8493de208871c82eb9b2f9fd10e80e3a3d592bbd3b3e5f6e801798e01fb454d700a7d632859402075130b7415ba66c8eaae85bdf559d8a57c62bf96578753b5c1c9e58d8e9345594a119cf618d21774b9d677ff2c618670edea3b887320723da39d5641267a026c7838902fb7460f06562806c3e0c20d7e7b259c34d91c0403621acec3ff5b3077a65f63b7c8acec74e966f9748d4a94f257c6d23dc32c8d975e8db8ec7442bd97447b8ad0353ffc2d0f4cb49b5e0ee5c5c03daac7684395863cc39a034d47392708e50d3360d8bb006e0510814473b406f693893653f3a1e8520e29905ff08a6ccff1e982cce843fd7bd953a15b6ea423c4ecf98631f8ea7e3b2d21f9cea5ffb578330662b0a1e1df2c7d12acd90c89deaca43a982c749c63d1267a96c9b6675d2808791192df47797bc19dc876f0fc5f7f75c336e3ea097881271b6831e059bd77cfb3e7d59997b722b7ec2a3a7897270a377fc1b09ba78d14540ab0496dbb384e540a15e8720d5258a8f05ac5c105552ba25e3d402c2a41fe7359444a84b689c582dc61e7a31553e66a44ab6d7e8a08a0907572fa0cad677229eba699ae206fa0ccdf4e5f1ba2a2a29e5318ed304ef71b04be3a723b585708dd9b3d7db23a6aa1dcf44765b772b7024c4aaaf196abaecabbea8b49e4eb17c2b91f66957043ce10d7d4d6f8e9adced95de848262ce57d3c8f0b0e4f221889d22b04b01bf373a7594a075148b2d8da141c7f876d2964715ae85e7a73212aa8bd6e4bbd072912f9545e7b33c9c44086071e78b1a23a4fcf3aa3b6b8bfc962605ed7760af2f46a5f2cb50c70f615f35b847e22c04da3a80c6a01c3943610d640015f9af4b156fa82c23ad650d0307f4b63a70fde632f64a33ac7e30c112ec07e5cd60b19b405e17a69371774f8a6f515f083304f9d232a32eb851933e83b59d61cccf8d23eb3d8d4193d868d441280673dea2817071f1f0e5adb55526fd1584540f9df7a93ef9cc730ab3375818242ae7f0ea17bff8b31b5903e11cd636abad4d2d0104a05210e510e2d73b2373558d57dbb2dacb129639b95e215980385810b5b914a5c8be3c429f9c660404e4b4f27d587c762be01b833e403116f94dd39159eae20cdcea6516c56681cbf522e2299adcdef8f31bc30088cde95cf276aad939530afd7a12ca61fc0242682a103c7de39b278d27896182f4c253b3d69e1942f89a677f1664c58203f7063733618ef02be140c73003b34a727fcd203c46c93"}) [ 3400.526248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3400.533492] R13: 00007ffce046c59f R14: 00007f0bfde37300 R15: 0000000000022000 09:01:13 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r2, 0x101}, 0x14}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NET_DM_CMD_STOP(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x41) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r2, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfc2e}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x3911af32e7d093d2) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) [ 3400.618665] FAULT_INJECTION: forcing a failure. [ 3400.618665] name failslab, interval 1, probability 0, space 0, times 0 [ 3400.633203] CPU: 1 PID: 22530 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 [ 3400.641110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3400.650459] Call Trace: [ 3400.653055] dump_stack+0x1b2/0x281 [ 3400.656688] should_fail.cold+0x10a/0x149 [ 3400.660836] should_failslab+0xd6/0x130 [ 3400.664800] kmem_cache_alloc_node+0x263/0x410 [ 3400.669365] __alloc_skb+0x5c/0x510 [ 3400.672978] netlink_dump+0x21b/0xb90 [ 3400.676770] __netlink_dump_start+0x4e2/0x740 [ 3400.681251] ? genl_lock_dumpit+0x90/0x90 [ 3400.685384] genl_family_rcv_msg+0x95c/0xb20 [ 3400.689778] ? __lock_acquire+0x5fc/0x3f20 [ 3400.693995] ? genl_rcv+0x40/0x40 [ 3400.697426] ? genl_lock_dumpit+0x90/0x90 [ 3400.701554] ? genl_lock_done+0xc0/0xc0 [ 3400.705505] ? genl_unlock+0x20/0x20 [ 3400.709201] ? trace_hardirqs_on_caller+0x3a8/0x580 [ 3400.714197] ? __dev_queue_xmit+0xc96/0x2480 [ 3400.718595] ? __local_bh_enable_ip+0xc1/0x170 [ 3400.723157] ? __dev_queue_xmit+0xcd6/0x2480 [ 3400.727543] ? __radix_tree_lookup+0x1b5/0x2e0 [ 3400.732108] genl_rcv_msg+0xaf/0x140 [ 3400.735823] netlink_rcv_skb+0x125/0x390 [ 3400.739869] ? genl_family_rcv_msg+0xb20/0xb20 [ 3400.744436] ? netlink_ack+0x9a0/0x9a0 [ 3400.748317] ? lock_acquire+0x170/0x3f0 [ 3400.752281] genl_rcv+0x24/0x40 [ 3400.755542] netlink_unicast+0x437/0x610 [ 3400.759587] ? netlink_sendskb+0xd0/0xd0 [ 3400.763634] ? __check_object_size+0x179/0x230 [ 3400.768292] netlink_sendmsg+0x648/0xbc0 [ 3400.772337] ? nlmsg_notify+0x1b0/0x1b0 [ 3400.776292] ? kernel_recvmsg+0x210/0x210 [ 3400.780425] ? security_socket_sendmsg+0x83/0xb0 [ 3400.785172] ? nlmsg_notify+0x1b0/0x1b0 [ 3400.789132] sock_sendmsg+0xb5/0x100 [ 3400.792830] ___sys_sendmsg+0x6c8/0x800 [ 3400.796790] ? get_pid_task+0x91/0x130 [ 3400.800658] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 3400.805413] ? lock_downgrade+0x740/0x740 [ 3400.809547] ? __fget+0x23e/0x3e0 [ 3400.812984] ? lock_acquire+0x170/0x3f0 [ 3400.816941] ? lock_downgrade+0x740/0x740 [ 3400.821079] ? __fget+0x265/0x3e0 [ 3400.824520] ? __fdget+0x19b/0x1f0 [ 3400.828043] ? sockfd_lookup_light+0xb2/0x160 [ 3400.832522] __sys_sendmsg+0xa3/0x120 [ 3400.836306] ? SyS_shutdown+0x160/0x160 [ 3400.840262] ? wait_for_completion_io+0x10/0x10 [ 3400.844918] ? SyS_read+0x210/0x210 [ 3400.848528] SyS_sendmsg+0x27/0x40 [ 3400.852048] ? __sys_sendmsg+0x120/0x120 [ 3400.856091] do_syscall_64+0x1d5/0x640 [ 3400.859964] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3400.865131] RIP: 0033:0x7f38870460c9 09:01:14 executing program 2: r0 = getuid() setresuid(0x0, 0xee01, r0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setresuid(r0, r1, r2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) setresuid(0x0, 0xee01, r0) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) (async) setresuid(r0, r1, r2) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:14 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x602602, 0x0) socket(0x1, 0x1, 0x80b) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x802, 0x0) (async) r2 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) write$yama_ptrace_scope(r2, 0x0, 0x0) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001440)={0xa0, 0x0, &(0x7f0000000380)=[@release={0x40046306, 0x1}, @clear_death, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/211, 0xd3, 0x0, 0x18}, @ptr={0x70742a85, 0x1, &(0x7f0000001480)=""/83, 0x53, 0x2, 0x7ff}, @fda={0x66646185, 0x3, 0x0, 0x33}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x100b, 0x1}, @fda={0x66646185, 0x7, 0x0, 0x34}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000001500)={0x0, 0x18, 0x38}}}], 0x1000, 0x0, &(0x7f0000000440)="f9ddce71c2ef4f7aaeb8b639bebfdf0567eb1b9e3dd32d2cc93de3b08ffc4f5745ca611f30a8951fb6d9a82b17ab91721aea9dceed19e50ddf5119109dfdfaa6cd8575b6c612ae8a1f3adbbfdf63128e47937c5e009d0bd8c37517908549a52a15e6ffb5f31b5b003a643897643e19051558afa21079a62f970ea73b643ce1af48f19b30983264283abaef6f688b7fb66d7f27f4cd0ef93cab26e94a044c614539567fe9ee22c16942add9c1c3546fba41270fb49c781b69d32122393bea5a0b7b86e5623af87025388c97a7f4ef44e86aad2e4c46341cd5684b5b2397c4f6b8277109f1b4d5820e69bb43848fa7e1189a9eb79f655ba0b1b63523db661228a13fc222c0b75f4fccc58d0a4e7dcacef98fa9817d2af1ab71cf140ec8b4d59fd87331536c5a4eff9421b51d87b2b0d1ddc21b9697199013c26bdf0453e3eca670b3875dc771e9f62d1b61e7c8a7dda023eea16840c00dd2c0b797169f2447a999dcc39519711728fc3c29f87ad780ffc0e3c30c63d6091c54e56062d86f6ecd588fd8b3ba315c3bd61a52b72773080f7c84d50f77e5d166df46e16cabd1508854f618c2b28418ceee8343e2c8a7d779e232f0f0bbb44d3032a0243601a915a2f6b95d71e63f370b3e4664f4d201276b3dc0237a96c340978979233ce8ba5f825adc4afc983ff41f77ba902571cc810c277d2da9053e58d786e4c060c75c27fa1b817563f77c279155ecdc87618e4b36413afdc8b4bf9a511ce628b70f6ec22896c829c2acdbdc167d5fd084ec3b1fbac30b8e934aa473e8909ac83bca0670c7cb156d9371d7f2be60dc2e0a218b7a95e46e2c83d03050682af21f123badd2f09900bd132a2f108880796dd1d45e044d1185f761d2ed9e43f23a1fd9877627d7448b44e33c0c6c29d32e8e8b798401e0e8422da7a1d416691b27346355246eafdd02fa8cd689945c861a22a04c0fe4ded0e77276c3508ff091639ad468114c018fc932a5e4d60f4e6b97d8bb9a3fc21bb84f6900815fe666a34ceda0590ee3d6b32e5b5412c82869d1446992a5733a16f0d9033ec9a63930cb9da3db2abe2ec6467efc16972700c11a33bd81241bcce13c4290290070989064760e15c24be856b1c81f5f02ad2fbf89a97dcfacfeb2aa9244f77509e1f7b27ec9baf41bb031d8e135157f48202782514cde4cca71e8896169cc0cf9cd78a47595000a7133b41cd5a790ed3a307f1d2db8fc6d8f067bcb8042823a3d1cdb825795873685aafedcc143d864bb20ed3264a757a78b3748049a5f21dcfccc1f2e94b332e16e662a729470a0f4188aca44857c0ffd0a32c4919e7e6a3a4de35b55141d30c2c593b97dba947d8ce8da798c2dbb5b14ace8100de452d5967ceef36434cbf9b02a080d1bab90032331dd9bbc81f6031513621e5f5b883ed339e42f07b0b3b11464f5fc8e0d089cb6c2e17427b40e7f6c83013711f9366eb8cbe55832613e6abe2b39bec29b99b47769377bd6d7c96be117e9b62617d543b5234344b939ade6668a0c810c86dc408fb4fe016e6c0fef2cc19cbd59550ede1abea0f8ad6611aca5a9f26c030bd7cdc488205ecd90521d6198bc69f656d26f45acd5819c03566f0cdb512e1194a9042e151a3259e128197371a564c2e74fd723092e097dcd2de322adfcfe131907f393b4ef8b7f0bc3bd536de9fc0fe0c1f4712469f2f537a48f4aaadd235e925b91956a5e6bdcce82ee0521c9e0ca03b2f54f7a871e6bc74d94e28bd3c05599293612a2e817c792c25673352be9f65dd837a4f74847b6e4b659583a8111fc625515145cce41b522d253fd2448d4cd76807f600652d2068a4ee3e77dcf02c7da2bdc528eda34c3c939f904feee557612059a36d64f9e1f22c46ac4f0fac069547229557d4bac16fea23f8bd9c42371e68a1a0936ee2fcc0c10eb19eaef6303d852257642be6112e12493d1c175d4a8469b00cd3420b0c3449f67dfac81131bbf753172f2dc950b4680261c0b8dfcc0558b1f0d100dccb1229c1c3524a37d45f7fcce1f4430b15acaac7aad949686607de513ec602c9301150bce2e862205d1b670ae2fa1a48620ad34111e5026a8a3a01595cfb145e0c37156b874b01fa5a10edc16b17067ba82131ef42019d3d75ab4bb0632dfc216ac7ac4a4c5d95f9d7e67fecc502ec28dcc33f3b3648bff13b07acc9062f8b82355d252941990ddc68f61f30c673a80deffc2e5628fd08edde71ab0c25940823f688fc3ea240d0c0900071529cc14720c201526da7d260e5a1cf29345633aac535cc9afb6a381d653307a8340ddebab15e3db8b7c6e1a22015c3a460af05c9af1c3514be3bf0a7f387042fa126a05b0f7878daf807fc962a82af0022a55b53796ceb82ce7b0298c9a829d951bd40b117c39c011c8ddd2e2fdd354d6178dbf3cdd176c775123a0009991374aaa9c0cbffa2453326d67eaf0195ba326b65b0423418a761d40ed707e383d4da443abe9e49ec2eb8bc92a1914e18df0e5001fe079e587b0f641a11d18e6f161a84eba226b422170371812afd66e7d3f5b6ff1b921b8c470c23e5e41ae5da60b0c62fac16494f2d7c158b6e271a8c941574387ee58eca54d56c7ed6291e3761150c264415849d12be6361f50f60366d83fb921145b29f0d66e7f14ff380abc7207a7a2327b61752f1dacdbec56a4c9b0f9e3472fbdb19f31be73fa3d1de9db88179999ca905ebbfc4a4fe2ad60f54a75dc30e9baa4cf194cf773707a8accfd9d1a58a8a0614d9470f8b8c0744cfe800db89f51c23add8849ab2ab3cd35e6d525794c594b214ebe3c0048129974a8e02d3817debdbd833ec4ba121ae8fe0bd9d1d599a8389a2e870b9c394c7b6d3f8dc86db254b9b695c15f07c0eecd975ad88abf04445091d4b0332aa4d538a37964d77594afe7b56c572d3e659f35b4a725eeee8a1196404265f982e18e84ea52fdbba1db1440a2270648903508d58812b6a65808b4efa8dbffc44177e1c03aeb97311782a2275805c396cfab107fed746a65a58fe8e3a2275ce389d20a1313e88589026a9f5a56d134c8c4363db8b2e505bdbd601dc70ebd7484934d44881b05038b4a70da1b0af8ed7ee76f5ceeb660fd5f9fa8445cc6c4e44027759a7fd4a6be90e37e9254f4be1743279b3997c77c78034d958afcd71db914c61945d5ce91211b3069a8f33ce49f0a1fbf5391d2e4eada40a31d8eb44510ee453adb7d9028fcdbfc2b4ee0ce69e7b3f24c62d815f0dd23e441bd6535ef55d328e592d1cb6aaeaea14cc4812da84127854e45d5d135b1ae8111a16fe1dabf899aa5508f4f104b4ca54a8f34d7cab882396f520dbd27a0a2ff4dc5f8df64139112ba4f1db715039ba778e82ed4308bf605e395faa72b4d4080d2a40d697975fbafe25be6ee6bb4c5d49748099b67981f21e814b971b9f491ebfd2b03ee48a9f6217a19ae617c275d00444f76b3b30aca4c81b0d56b9116534eafb23265db24d4b507bf53f11d393c19c0bda085b69a53bf3b75d28a9118c53785b00eb66aed34f002878f3b912d72e795c547ae764e7788c05762bfa91a38b5c9343952f8e1ea59016db3871c5ac70b295dc15ece920862b5b465498dc61633a4ccb02d63d9df6bb3c1aed796fd95c23503f843be3901fedbb2c7b7a09028fbfb98e5cfece5426f98e7ba7eb262eac55fce5ff2209e7a9bb48e4f9b28e121e54d8229635ed555bc86eabf4d4bf00d5453067c8da0c31a520188e67890a0c3a0ebc87a028564b59bdb1b39730b02c3d430b95a79c0a7b4614e170f8e135aa350e62d884b01601a01b06cfe0c6e75966dff3dcd2bf591392c294fa1c017227f66b433f852b3784b422e42eac103c32ed6f0d60a372972f380c686adc85b82decc01a45fc7e19a2326ca4f88bb101a1b2fd7df06dfeb33b16b2dbb3a75414eead2055cd30522fbe2c5cc487267c23564a98fe53e323f76c85ab6f02313857cf97050852385430eb97efc35880c071ea995c6f9c06f45a7017aa54a892b4f9a4a2a4d32db16fcd3ff1a43b18159d8bcc091a4efd5c96ff60402c22ab99f698ca28de3ee83a4030ee3b477311f789703dd4c342e51934a12c7a21e5e00b02a6ed44e12b93c6ce373eb00e4d25351273e4110646df62344acea03e1b0ed6e24ba83d4759f9a34384a4159b2de6620d960ffede01a045304849a8a53be2925ad1174e332f81c313e86a4f47b4706b6c4b3c9f84fe20829ddaa7e2fd729ea150f4344007bfe3f84ad2421d6dbad75187c215775140a3fc66001bc0b3a83c042b0a106185adbce4f88e1542b84dc1cb69c9e4e2e227b10870fed486375a2b3047e1683135cc14a1a56142cd01909e1414dc196ba2df00bd91f96cdf4f3cfc01a24cc552f45d4b02b5c7a97040235851a58c281e0f095e05265735bbf72a5702a73117189c6dd41cdaa5a50066f75b1d6f93098cceaa44c51370c709968dd7bad3eae378218e45cb46c297e7a63cd3696adbf3109520bfcfba5e472c7b2ac89f3e14f3a3da8493de208871c82eb9b2f9fd10e80e3a3d592bbd3b3e5f6e801798e01fb454d700a7d632859402075130b7415ba66c8eaae85bdf559d8a57c62bf96578753b5c1c9e58d8e9345594a119cf618d21774b9d677ff2c618670edea3b887320723da39d5641267a026c7838902fb7460f06562806c3e0c20d7e7b259c34d91c0403621acec3ff5b3077a65f63b7c8acec74e966f9748d4a94f257c6d23dc32c8d975e8db8ec7442bd97447b8ad0353ffc2d0f4cb49b5e0ee5c5c03daac7684395863cc39a034d47392708e50d3360d8bb006e0510814473b406f693893653f3a1e8520e29905ff08a6ccff1e982cce843fd7bd953a15b6ea423c4ecf98631f8ea7e3b2d21f9cea5ffb578330662b0a1e1df2c7d12acd90c89deaca43a982c749c63d1267a96c9b6675d2808791192df47797bc19dc876f0fc5f7f75c336e3ea097881271b6831e059bd77cfb3e7d59997b722b7ec2a3a7897270a377fc1b09ba78d14540ab0496dbb384e540a15e8720d5258a8f05ac5c105552ba25e3d402c2a41fe7359444a84b689c582dc61e7a31553e66a44ab6d7e8a08a0907572fa0cad677229eba699ae206fa0ccdf4e5f1ba2a2a29e5318ed304ef71b04be3a723b585708dd9b3d7db23a6aa1dcf44765b772b7024c4aaaf196abaecabbea8b49e4eb17c2b91f66957043ce10d7d4d6f8e9adced95de848262ce57d3c8f0b0e4f221889d22b04b01bf373a7594a075148b2d8da141c7f876d2964715ae85e7a73212aa8bd6e4bbd072912f9545e7b33c9c44086071e78b1a23a4fcf3aa3b6b8bfc962605ed7760af2f46a5f2cb50c70f615f35b847e22c04da3a80c6a01c3943610d640015f9af4b156fa82c23ad650d0307f4b63a70fde632f64a33ac7e30c112ec07e5cd60b19b405e17a69371774f8a6f515f083304f9d232a32eb851933e83b59d61cccf8d23eb3d8d4193d868d441280673dea2817071f1f0e5adb55526fd1584540f9df7a93ef9cc730ab3375818242ae7f0ea17bff8b31b5903e11cd636abad4d2d0104a05210e510e2d73b2373558d57dbb2dacb129639b95e215980385810b5b914a5c8be3c429f9c660404e4b4f27d587c762be01b833e403116f94dd39159eae20cdcea6516c56681cbf522e2299adcdef8f31bc30088cde95cf276aad939530afd7a12ca61fc0242682a103c7de39b278d27896182f4c253b3d69e1942f89a677f1664c58203f7063733618ef02be140c73003b34a727fcd203c46c93"}) (rerun: 32) 09:01:14 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48084}, 0x4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x19, 0x31, 0x4, 0x1b, 0x1, 0xfff, 0x2, 0x5f, 0x1}}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48084}, 0x4) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x19, 0x31, 0x4, 0x1b, 0x1, 0xfff, 0x2, 0x5f, 0x1}}) (async) [ 3400.868822] RSP: 002b:00007f38855b8168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3400.876509] RAX: ffffffffffffffda RBX: 00007f3887165f80 RCX: 00007f38870460c9 [ 3400.883756] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 3400.891006] RBP: 00007f38855b81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3400.898270] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3400.905516] R13: 00007ffdf76a3ddf R14: 00007f38855b8300 R15: 0000000000022000 09:01:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 5) 09:01:14 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r2, 0x101}, 0x14}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NET_DM_CMD_STOP(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x41) (async, rerun: 64) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r2, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfc2e}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x3911af32e7d093d2) (async, rerun: 64) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) [ 3400.982234] FAULT_INJECTION: forcing a failure. [ 3400.982234] name failslab, interval 1, probability 0, space 0, times 0 [ 3401.001705] CPU: 0 PID: 22538 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3401.009609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3401.018956] Call Trace: [ 3401.021538] dump_stack+0x1b2/0x281 [ 3401.025164] should_fail.cold+0x10a/0x149 [ 3401.029307] should_failslab+0xd6/0x130 [ 3401.033274] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3401.038375] throtl_pd_alloc+0x59/0x990 [ 3401.042339] ? throtl_add_bio_tg+0x1e0/0x1e0 [ 3401.046746] blkcg_activate_policy+0x115/0x5c0 [ 3401.051320] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 3401.056337] blk_throtl_init+0x408/0x590 [ 3401.060402] blkcg_init_queue+0x18f/0x410 [ 3401.064559] blk_alloc_queue_node+0x826/0xb40 [ 3401.069059] blk_mq_init_queue+0x42/0x90 [ 3401.073116] loop_add+0x303/0x830 [ 3401.076564] ? loop_queue_rq+0x280/0x280 09:01:14 executing program 2: getuid() r0 = getuid() r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(r1, r0, r2) r3 = getuid() r4 = getuid() setresuid(r3, r4, 0xee00) setresuid(0x0, 0xee01, r3) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:14 executing program 2: getuid() (async) r0 = getuid() (async) r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(r1, r0, r2) r3 = getuid() (async) r4 = getuid() setresuid(r3, r4, 0xee00) setresuid(0x0, 0xee01, r3) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:14 executing program 2: getuid() r0 = getuid() r1 = getuid() (async, rerun: 32) r2 = getuid() (rerun: 32) setresuid(r1, r2, 0xee00) setresuid(r1, r0, r2) (async) r3 = getuid() (async, rerun: 32) r4 = getuid() (rerun: 32) setresuid(r3, r4, 0xee00) (async) setresuid(0x0, 0xee01, r3) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3401.080619] ? loop_queue_work+0x21e0/0x21e0 [ 3401.085029] loop_control_ioctl+0x11a/0x3f0 [ 3401.089343] ? loop_lookup+0x190/0x190 [ 3401.093225] ? SyS_write+0x1b7/0x210 [ 3401.096936] ? loop_lookup+0x190/0x190 [ 3401.100820] do_vfs_ioctl+0x75a/0xff0 [ 3401.104619] ? lock_acquire+0x170/0x3f0 [ 3401.108595] ? ioctl_preallocate+0x1a0/0x1a0 [ 3401.113001] ? __fget+0x265/0x3e0 [ 3401.116454] ? do_vfs_ioctl+0xff0/0xff0 [ 3401.120436] ? security_file_ioctl+0x83/0xb0 [ 3401.124844] SyS_ioctl+0x7f/0xb0 [ 3401.128206] ? do_vfs_ioctl+0xff0/0xff0 [ 3401.132183] do_syscall_64+0x1d5/0x640 [ 3401.136081] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3401.141270] RIP: 0033:0x7f0bff8e60c9 [ 3401.144984] RSP: 002b:00007f0bfde37168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3401.152689] RAX: ffffffffffffffda RBX: 00007f0bffa06050 RCX: 00007f0bff8e60c9 [ 3401.159964] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3401.167226] RBP: 00007f0bfde371d0 R08: 0000000000000000 R09: 0000000000000000 [ 3401.174483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:14 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 30) 09:01:14 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:14 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x602602, 0x0) socket(0x1, 0x1, 0x80b) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x802, 0x0) (async, rerun: 64) r2 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000f40), 0x2, 0x0) (rerun: 64) write$yama_ptrace_scope(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001440)={0xa0, 0x0, &(0x7f0000000380)=[@release={0x40046306, 0x1}, @clear_death, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/211, 0xd3, 0x0, 0x18}, @ptr={0x70742a85, 0x1, &(0x7f0000001480)=""/83, 0x53, 0x2, 0x7ff}, @fda={0x66646185, 0x3, 0x0, 0x33}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x100b, 0x1}, @fda={0x66646185, 0x7, 0x0, 0x34}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000001500)={0x0, 0x18, 0x38}}}], 0x1000, 0x0, &(0x7f0000000440)="f9ddce71c2ef4f7aaeb8b639bebfdf0567eb1b9e3dd32d2cc93de3b08ffc4f5745ca611f30a8951fb6d9a82b17ab91721aea9dceed19e50ddf5119109dfdfaa6cd8575b6c612ae8a1f3adbbfdf63128e47937c5e009d0bd8c37517908549a52a15e6ffb5f31b5b003a643897643e19051558afa21079a62f970ea73b643ce1af48f19b30983264283abaef6f688b7fb66d7f27f4cd0ef93cab26e94a044c614539567fe9ee22c16942add9c1c3546fba41270fb49c781b69d32122393bea5a0b7b86e5623af87025388c97a7f4ef44e86aad2e4c46341cd5684b5b2397c4f6b8277109f1b4d5820e69bb43848fa7e1189a9eb79f655ba0b1b63523db661228a13fc222c0b75f4fccc58d0a4e7dcacef98fa9817d2af1ab71cf140ec8b4d59fd87331536c5a4eff9421b51d87b2b0d1ddc21b9697199013c26bdf0453e3eca670b3875dc771e9f62d1b61e7c8a7dda023eea16840c00dd2c0b797169f2447a999dcc39519711728fc3c29f87ad780ffc0e3c30c63d6091c54e56062d86f6ecd588fd8b3ba315c3bd61a52b72773080f7c84d50f77e5d166df46e16cabd1508854f618c2b28418ceee8343e2c8a7d779e232f0f0bbb44d3032a0243601a915a2f6b95d71e63f370b3e4664f4d201276b3dc0237a96c340978979233ce8ba5f825adc4afc983ff41f77ba902571cc810c277d2da9053e58d786e4c060c75c27fa1b817563f77c279155ecdc87618e4b36413afdc8b4bf9a511ce628b70f6ec22896c829c2acdbdc167d5fd084ec3b1fbac30b8e934aa473e8909ac83bca0670c7cb156d9371d7f2be60dc2e0a218b7a95e46e2c83d03050682af21f123badd2f09900bd132a2f108880796dd1d45e044d1185f761d2ed9e43f23a1fd9877627d7448b44e33c0c6c29d32e8e8b798401e0e8422da7a1d416691b27346355246eafdd02fa8cd689945c861a22a04c0fe4ded0e77276c3508ff091639ad468114c018fc932a5e4d60f4e6b97d8bb9a3fc21bb84f6900815fe666a34ceda0590ee3d6b32e5b5412c82869d1446992a5733a16f0d9033ec9a63930cb9da3db2abe2ec6467efc16972700c11a33bd81241bcce13c4290290070989064760e15c24be856b1c81f5f02ad2fbf89a97dcfacfeb2aa9244f77509e1f7b27ec9baf41bb031d8e135157f48202782514cde4cca71e8896169cc0cf9cd78a47595000a7133b41cd5a790ed3a307f1d2db8fc6d8f067bcb8042823a3d1cdb825795873685aafedcc143d864bb20ed3264a757a78b3748049a5f21dcfccc1f2e94b332e16e662a729470a0f4188aca44857c0ffd0a32c4919e7e6a3a4de35b55141d30c2c593b97dba947d8ce8da798c2dbb5b14ace8100de452d5967ceef36434cbf9b02a080d1bab90032331dd9bbc81f6031513621e5f5b883ed339e42f07b0b3b11464f5fc8e0d089cb6c2e17427b40e7f6c83013711f9366eb8cbe55832613e6abe2b39bec29b99b47769377bd6d7c96be117e9b62617d543b5234344b939ade6668a0c810c86dc408fb4fe016e6c0fef2cc19cbd59550ede1abea0f8ad6611aca5a9f26c030bd7cdc488205ecd90521d6198bc69f656d26f45acd5819c03566f0cdb512e1194a9042e151a3259e128197371a564c2e74fd723092e097dcd2de322adfcfe131907f393b4ef8b7f0bc3bd536de9fc0fe0c1f4712469f2f537a48f4aaadd235e925b91956a5e6bdcce82ee0521c9e0ca03b2f54f7a871e6bc74d94e28bd3c05599293612a2e817c792c25673352be9f65dd837a4f74847b6e4b659583a8111fc625515145cce41b522d253fd2448d4cd76807f600652d2068a4ee3e77dcf02c7da2bdc528eda34c3c939f904feee557612059a36d64f9e1f22c46ac4f0fac069547229557d4bac16fea23f8bd9c42371e68a1a0936ee2fcc0c10eb19eaef6303d852257642be6112e12493d1c175d4a8469b00cd3420b0c3449f67dfac81131bbf753172f2dc950b4680261c0b8dfcc0558b1f0d100dccb1229c1c3524a37d45f7fcce1f4430b15acaac7aad949686607de513ec602c9301150bce2e862205d1b670ae2fa1a48620ad34111e5026a8a3a01595cfb145e0c37156b874b01fa5a10edc16b17067ba82131ef42019d3d75ab4bb0632dfc216ac7ac4a4c5d95f9d7e67fecc502ec28dcc33f3b3648bff13b07acc9062f8b82355d252941990ddc68f61f30c673a80deffc2e5628fd08edde71ab0c25940823f688fc3ea240d0c0900071529cc14720c201526da7d260e5a1cf29345633aac535cc9afb6a381d653307a8340ddebab15e3db8b7c6e1a22015c3a460af05c9af1c3514be3bf0a7f387042fa126a05b0f7878daf807fc962a82af0022a55b53796ceb82ce7b0298c9a829d951bd40b117c39c011c8ddd2e2fdd354d6178dbf3cdd176c775123a0009991374aaa9c0cbffa2453326d67eaf0195ba326b65b0423418a761d40ed707e383d4da443abe9e49ec2eb8bc92a1914e18df0e5001fe079e587b0f641a11d18e6f161a84eba226b422170371812afd66e7d3f5b6ff1b921b8c470c23e5e41ae5da60b0c62fac16494f2d7c158b6e271a8c941574387ee58eca54d56c7ed6291e3761150c264415849d12be6361f50f60366d83fb921145b29f0d66e7f14ff380abc7207a7a2327b61752f1dacdbec56a4c9b0f9e3472fbdb19f31be73fa3d1de9db88179999ca905ebbfc4a4fe2ad60f54a75dc30e9baa4cf194cf773707a8accfd9d1a58a8a0614d9470f8b8c0744cfe800db89f51c23add8849ab2ab3cd35e6d525794c594b214ebe3c0048129974a8e02d3817debdbd833ec4ba121ae8fe0bd9d1d599a8389a2e870b9c394c7b6d3f8dc86db254b9b695c15f07c0eecd975ad88abf04445091d4b0332aa4d538a37964d77594afe7b56c572d3e659f35b4a725eeee8a1196404265f982e18e84ea52fdbba1db1440a2270648903508d58812b6a65808b4efa8dbffc44177e1c03aeb97311782a2275805c396cfab107fed746a65a58fe8e3a2275ce389d20a1313e88589026a9f5a56d134c8c4363db8b2e505bdbd601dc70ebd7484934d44881b05038b4a70da1b0af8ed7ee76f5ceeb660fd5f9fa8445cc6c4e44027759a7fd4a6be90e37e9254f4be1743279b3997c77c78034d958afcd71db914c61945d5ce91211b3069a8f33ce49f0a1fbf5391d2e4eada40a31d8eb44510ee453adb7d9028fcdbfc2b4ee0ce69e7b3f24c62d815f0dd23e441bd6535ef55d328e592d1cb6aaeaea14cc4812da84127854e45d5d135b1ae8111a16fe1dabf899aa5508f4f104b4ca54a8f34d7cab882396f520dbd27a0a2ff4dc5f8df64139112ba4f1db715039ba778e82ed4308bf605e395faa72b4d4080d2a40d697975fbafe25be6ee6bb4c5d49748099b67981f21e814b971b9f491ebfd2b03ee48a9f6217a19ae617c275d00444f76b3b30aca4c81b0d56b9116534eafb23265db24d4b507bf53f11d393c19c0bda085b69a53bf3b75d28a9118c53785b00eb66aed34f002878f3b912d72e795c547ae764e7788c05762bfa91a38b5c9343952f8e1ea59016db3871c5ac70b295dc15ece920862b5b465498dc61633a4ccb02d63d9df6bb3c1aed796fd95c23503f843be3901fedbb2c7b7a09028fbfb98e5cfece5426f98e7ba7eb262eac55fce5ff2209e7a9bb48e4f9b28e121e54d8229635ed555bc86eabf4d4bf00d5453067c8da0c31a520188e67890a0c3a0ebc87a028564b59bdb1b39730b02c3d430b95a79c0a7b4614e170f8e135aa350e62d884b01601a01b06cfe0c6e75966dff3dcd2bf591392c294fa1c017227f66b433f852b3784b422e42eac103c32ed6f0d60a372972f380c686adc85b82decc01a45fc7e19a2326ca4f88bb101a1b2fd7df06dfeb33b16b2dbb3a75414eead2055cd30522fbe2c5cc487267c23564a98fe53e323f76c85ab6f02313857cf97050852385430eb97efc35880c071ea995c6f9c06f45a7017aa54a892b4f9a4a2a4d32db16fcd3ff1a43b18159d8bcc091a4efd5c96ff60402c22ab99f698ca28de3ee83a4030ee3b477311f789703dd4c342e51934a12c7a21e5e00b02a6ed44e12b93c6ce373eb00e4d25351273e4110646df62344acea03e1b0ed6e24ba83d4759f9a34384a4159b2de6620d960ffede01a045304849a8a53be2925ad1174e332f81c313e86a4f47b4706b6c4b3c9f84fe20829ddaa7e2fd729ea150f4344007bfe3f84ad2421d6dbad75187c215775140a3fc66001bc0b3a83c042b0a106185adbce4f88e1542b84dc1cb69c9e4e2e227b10870fed486375a2b3047e1683135cc14a1a56142cd01909e1414dc196ba2df00bd91f96cdf4f3cfc01a24cc552f45d4b02b5c7a97040235851a58c281e0f095e05265735bbf72a5702a73117189c6dd41cdaa5a50066f75b1d6f93098cceaa44c51370c709968dd7bad3eae378218e45cb46c297e7a63cd3696adbf3109520bfcfba5e472c7b2ac89f3e14f3a3da8493de208871c82eb9b2f9fd10e80e3a3d592bbd3b3e5f6e801798e01fb454d700a7d632859402075130b7415ba66c8eaae85bdf559d8a57c62bf96578753b5c1c9e58d8e9345594a119cf618d21774b9d677ff2c618670edea3b887320723da39d5641267a026c7838902fb7460f06562806c3e0c20d7e7b259c34d91c0403621acec3ff5b3077a65f63b7c8acec74e966f9748d4a94f257c6d23dc32c8d975e8db8ec7442bd97447b8ad0353ffc2d0f4cb49b5e0ee5c5c03daac7684395863cc39a034d47392708e50d3360d8bb006e0510814473b406f693893653f3a1e8520e29905ff08a6ccff1e982cce843fd7bd953a15b6ea423c4ecf98631f8ea7e3b2d21f9cea5ffb578330662b0a1e1df2c7d12acd90c89deaca43a982c749c63d1267a96c9b6675d2808791192df47797bc19dc876f0fc5f7f75c336e3ea097881271b6831e059bd77cfb3e7d59997b722b7ec2a3a7897270a377fc1b09ba78d14540ab0496dbb384e540a15e8720d5258a8f05ac5c105552ba25e3d402c2a41fe7359444a84b689c582dc61e7a31553e66a44ab6d7e8a08a0907572fa0cad677229eba699ae206fa0ccdf4e5f1ba2a2a29e5318ed304ef71b04be3a723b585708dd9b3d7db23a6aa1dcf44765b772b7024c4aaaf196abaecabbea8b49e4eb17c2b91f66957043ce10d7d4d6f8e9adced95de848262ce57d3c8f0b0e4f221889d22b04b01bf373a7594a075148b2d8da141c7f876d2964715ae85e7a73212aa8bd6e4bbd072912f9545e7b33c9c44086071e78b1a23a4fcf3aa3b6b8bfc962605ed7760af2f46a5f2cb50c70f615f35b847e22c04da3a80c6a01c3943610d640015f9af4b156fa82c23ad650d0307f4b63a70fde632f64a33ac7e30c112ec07e5cd60b19b405e17a69371774f8a6f515f083304f9d232a32eb851933e83b59d61cccf8d23eb3d8d4193d868d441280673dea2817071f1f0e5adb55526fd1584540f9df7a93ef9cc730ab3375818242ae7f0ea17bff8b31b5903e11cd636abad4d2d0104a05210e510e2d73b2373558d57dbb2dacb129639b95e215980385810b5b914a5c8be3c429f9c660404e4b4f27d587c762be01b833e403116f94dd39159eae20cdcea6516c56681cbf522e2299adcdef8f31bc30088cde95cf276aad939530afd7a12ca61fc0242682a103c7de39b278d27896182f4c253b3d69e1942f89a677f1664c58203f7063733618ef02be140c73003b34a727fcd203c46c93"}) 09:01:14 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r2, 0x101}, 0x14}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NET_DM_CMD_STOP(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x41) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r2, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfc2e}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x3911af32e7d093d2) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, r2, 0x101}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NET_DM_CMD_STOP(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x41) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r2, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfc2e}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x3911af32e7d093d2) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) [ 3401.181753] R13: 00007ffce046c59f R14: 00007f0bfde37300 R15: 0000000000022000 09:01:14 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RTC_AIE_ON(r1, 0x7001) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) [ 3401.263157] FAULT_INJECTION: forcing a failure. [ 3401.263157] name failslab, interval 1, probability 0, space 0, times 0 [ 3401.294585] CPU: 0 PID: 22576 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 [ 3401.302486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3401.311926] Call Trace: [ 3401.314515] dump_stack+0x1b2/0x281 [ 3401.318150] should_fail.cold+0x10a/0x149 [ 3401.322296] should_failslab+0xd6/0x130 [ 3401.326267] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3401.331377] __kmalloc_node_track_caller+0x38/0x70 [ 3401.336309] __alloc_skb+0x96/0x510 [ 3401.339936] netlink_dump+0x21b/0xb90 [ 3401.340134] FAULT_INJECTION: forcing a failure. [ 3401.340134] name failslab, interval 1, probability 0, space 0, times 0 [ 3401.343733] __netlink_dump_start+0x4e2/0x740 [ 3401.343744] ? genl_lock_dumpit+0x90/0x90 09:01:14 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) [ 3401.343757] genl_family_rcv_msg+0x95c/0xb20 [ 3401.343772] ? __lock_acquire+0x5fc/0x3f20 [ 3401.343790] ? genl_rcv+0x40/0x40 [ 3401.375682] ? genl_lock_dumpit+0x90/0x90 [ 3401.379821] ? genl_lock_done+0xc0/0xc0 [ 3401.383780] ? genl_unlock+0x20/0x20 [ 3401.387494] ? trace_hardirqs_on_caller+0x3a8/0x580 [ 3401.392502] ? __dev_queue_xmit+0xc96/0x2480 [ 3401.396904] ? __local_bh_enable_ip+0xc1/0x170 [ 3401.401478] ? __dev_queue_xmit+0xcd6/0x2480 [ 3401.405871] ? __radix_tree_lookup+0x1b5/0x2e0 [ 3401.410445] genl_rcv_msg+0xaf/0x140 [ 3401.414146] netlink_rcv_skb+0x125/0x390 [ 3401.418191] ? genl_family_rcv_msg+0xb20/0xb20 [ 3401.422761] ? netlink_ack+0x9a0/0x9a0 [ 3401.426642] ? lock_acquire+0x170/0x3f0 [ 3401.430617] genl_rcv+0x24/0x40 [ 3401.433890] netlink_unicast+0x437/0x610 [ 3401.437942] ? netlink_sendskb+0xd0/0xd0 [ 3401.441987] ? __check_object_size+0x179/0x230 [ 3401.446550] netlink_sendmsg+0x648/0xbc0 [ 3401.450600] ? nlmsg_notify+0x1b0/0x1b0 [ 3401.454555] ? kernel_recvmsg+0x210/0x210 [ 3401.458741] ? security_socket_sendmsg+0x83/0xb0 [ 3401.463480] ? nlmsg_notify+0x1b0/0x1b0 [ 3401.467432] sock_sendmsg+0xb5/0x100 [ 3401.471125] ___sys_sendmsg+0x6c8/0x800 [ 3401.475084] ? get_pid_task+0x91/0x130 [ 3401.479906] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 3401.484642] ? lock_downgrade+0x740/0x740 [ 3401.488777] ? __fget+0x23e/0x3e0 [ 3401.492215] ? lock_acquire+0x170/0x3f0 [ 3401.496172] ? lock_downgrade+0x740/0x740 [ 3401.500305] ? __fget+0x265/0x3e0 [ 3401.503742] ? __fdget+0x19b/0x1f0 [ 3401.507262] ? sockfd_lookup_light+0xb2/0x160 [ 3401.511742] __sys_sendmsg+0xa3/0x120 [ 3401.515528] ? SyS_shutdown+0x160/0x160 [ 3401.519484] ? wait_for_completion_io+0x10/0x10 [ 3401.524137] ? SyS_read+0x210/0x210 [ 3401.527752] SyS_sendmsg+0x27/0x40 [ 3401.531279] ? __sys_sendmsg+0x120/0x120 [ 3401.535328] do_syscall_64+0x1d5/0x640 [ 3401.539217] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3401.544392] RIP: 0033:0x7f38870460c9 [ 3401.548086] RSP: 002b:00007f38855b8168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3401.555791] RAX: ffffffffffffffda RBX: 00007f3887165f80 RCX: 00007f38870460c9 [ 3401.563049] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 3401.570311] RBP: 00007f38855b81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3401.577572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3401.584833] R13: 00007ffdf76a3ddf R14: 00007f38855b8300 R15: 0000000000022000 [ 3401.592111] CPU: 1 PID: 22582 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3401.599996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3401.609344] Call Trace: [ 3401.611923] dump_stack+0x1b2/0x281 [ 3401.615545] should_fail.cold+0x10a/0x149 [ 3401.619695] should_failslab+0xd6/0x130 [ 3401.623671] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3401.628340] ? blk_mq_can_queue+0x40/0x40 [ 3401.632475] ? queue_set_hctx_shared+0x210/0x210 [ 3401.637208] blk_stat_alloc_callback+0x54/0x2f0 [ 3401.641856] blk_mq_init_allocated_queue+0x80/0xfd0 [ 3401.646863] ? blkcg_init_queue+0x19f/0x410 [ 3401.651180] ? blk_alloc_queue_node+0x82f/0xb40 [ 3401.655846] blk_mq_init_queue+0x5a/0x90 [ 3401.659897] loop_add+0x303/0x830 [ 3401.663334] ? loop_queue_rq+0x280/0x280 [ 3401.667374] ? loop_queue_work+0x21e0/0x21e0 [ 3401.671767] loop_control_ioctl+0x11a/0x3f0 [ 3401.676077] ? loop_lookup+0x190/0x190 [ 3401.679942] ? SyS_write+0x1b7/0x210 [ 3401.683637] ? loop_lookup+0x190/0x190 [ 3401.687500] do_vfs_ioctl+0x75a/0xff0 [ 3401.691278] ? lock_acquire+0x170/0x3f0 [ 3401.695229] ? ioctl_preallocate+0x1a0/0x1a0 [ 3401.699614] ? __fget+0x265/0x3e0 [ 3401.703057] ? do_vfs_ioctl+0xff0/0xff0 [ 3401.707006] ? security_file_ioctl+0x83/0xb0 [ 3401.711389] SyS_ioctl+0x7f/0xb0 [ 3401.714730] ? do_vfs_ioctl+0xff0/0xff0 [ 3401.718684] do_syscall_64+0x1d5/0x640 [ 3401.722550] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3401.727714] RIP: 0033:0x7f0bff8e60c9 [ 3401.731397] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3401.739090] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3401.746331] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3401.753574] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 09:01:15 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48084}, 0x4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x19, 0x31, 0x4, 0x1b, 0x1, 0xfff, 0x2, 0x5f, 0x1}}) 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) 09:01:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 6) 09:01:15 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_AIE_ON(r1, 0x7001) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:15 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 31) 09:01:15 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000200)) [ 3401.760818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3401.768074] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3401.873992] FAULT_INJECTION: forcing a failure. [ 3401.873992] name failslab, interval 1, probability 0, space 0, times 0 [ 3401.892359] CPU: 1 PID: 22612 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 [ 3401.900261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3401.909614] Call Trace: [ 3401.912201] dump_stack+0x1b2/0x281 [ 3401.915836] should_fail.cold+0x10a/0x149 [ 3401.919998] ? lock_acquire+0x170/0x3f0 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000080), 0xffffffff, 0x4800) recvmsg$unix(r2, &(0x7f0000001380)={&(0x7f00000000c0), 0x6e, &(0x7f0000001340)=[{&(0x7f0000000140)=""/251, 0xfb}, {&(0x7f0000000240)=""/72, 0x48}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/70, 0x46}], 0x4}, 0x40010030) setresuid(0xee01, r0, 0x0) setresuid(0x0, 0xffffffffffffffff, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) (async) r2 = syz_open_dev$mouse(&(0x7f0000000080), 0xffffffff, 0x4800) recvmsg$unix(r2, &(0x7f0000001380)={&(0x7f00000000c0), 0x6e, &(0x7f0000001340)=[{&(0x7f0000000140)=""/251, 0xfb}, {&(0x7f0000000240)=""/72, 0x48}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/70, 0x46}], 0x4}, 0x40010030) (async) setresuid(0xee01, r0, 0x0) setresuid(0x0, 0xffffffffffffffff, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) (async) r2 = syz_open_dev$mouse(&(0x7f0000000080), 0xffffffff, 0x4800) recvmsg$unix(r2, &(0x7f0000001380)={&(0x7f00000000c0), 0x6e, &(0x7f0000001340)=[{&(0x7f0000000140)=""/251, 0xfb}, {&(0x7f0000000240)=""/72, 0x48}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/70, 0x46}], 0x4}, 0x40010030) (async) setresuid(0xee01, r0, 0x0) setresuid(0x0, 0xffffffffffffffff, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3401.923972] should_failslab+0xd6/0x130 [ 3401.928058] kmem_cache_alloc+0x40/0x3c0 [ 3401.932118] skb_clone+0x126/0x9a0 [ 3401.935666] netlink_deliver_tap+0x67e/0x860 [ 3401.940091] netlink_dump+0x7fa/0xb90 [ 3401.943893] __netlink_dump_start+0x4e2/0x740 [ 3401.948389] ? genl_lock_dumpit+0x90/0x90 [ 3401.952548] genl_family_rcv_msg+0x95c/0xb20 [ 3401.956972] ? __lock_acquire+0x5fc/0x3f20 [ 3401.961207] ? genl_rcv+0x40/0x40 [ 3401.964672] ? genl_lock_dumpit+0x90/0x90 [ 3401.968816] ? genl_lock_done+0xc0/0xc0 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3401.972780] ? genl_unlock+0x20/0x20 [ 3401.976496] ? trace_hardirqs_on_caller+0x3a8/0x580 [ 3401.981511] ? __dev_queue_xmit+0xc96/0x2480 [ 3401.985916] ? __local_bh_enable_ip+0xc1/0x170 [ 3401.990494] ? __dev_queue_xmit+0xcd6/0x2480 [ 3401.994921] ? __radix_tree_lookup+0x1b5/0x2e0 [ 3401.999511] genl_rcv_msg+0xaf/0x140 [ 3402.003319] netlink_rcv_skb+0x125/0x390 [ 3402.007499] ? genl_family_rcv_msg+0xb20/0xb20 [ 3402.012083] ? netlink_ack+0x9a0/0x9a0 [ 3402.015964] ? lock_acquire+0x170/0x3f0 [ 3402.019934] genl_rcv+0x24/0x40 [ 3402.023212] netlink_unicast+0x437/0x610 [ 3402.027259] ? netlink_sendskb+0xd0/0xd0 [ 3402.031307] ? __check_object_size+0x179/0x230 [ 3402.035872] netlink_sendmsg+0x648/0xbc0 [ 3402.039920] ? nlmsg_notify+0x1b0/0x1b0 [ 3402.043868] ? kernel_recvmsg+0x210/0x210 [ 3402.047997] ? security_socket_sendmsg+0x83/0xb0 [ 3402.052730] ? nlmsg_notify+0x1b0/0x1b0 [ 3402.056686] sock_sendmsg+0xb5/0x100 [ 3402.060398] ___sys_sendmsg+0x6c8/0x800 [ 3402.064373] ? get_pid_task+0x91/0x130 [ 3402.068271] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 3402.073018] ? lock_downgrade+0x740/0x740 [ 3402.077145] ? __fget+0x23e/0x3e0 [ 3402.080579] ? lock_acquire+0x170/0x3f0 [ 3402.084533] ? lock_downgrade+0x740/0x740 [ 3402.088659] ? __fget+0x265/0x3e0 [ 3402.092103] ? __fdget+0x19b/0x1f0 [ 3402.095631] ? sockfd_lookup_light+0xb2/0x160 [ 3402.100111] __sys_sendmsg+0xa3/0x120 [ 3402.103895] ? SyS_shutdown+0x160/0x160 [ 3402.107849] ? wait_for_completion_io+0x10/0x10 [ 3402.112504] ? SyS_read+0x210/0x210 [ 3402.116112] SyS_sendmsg+0x27/0x40 [ 3402.119627] ? __sys_sendmsg+0x120/0x120 [ 3402.123761] do_syscall_64+0x1d5/0x640 [ 3402.127639] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3402.132810] RIP: 0033:0x7f38870460c9 [ 3402.136591] RSP: 002b:00007f38855b8168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3402.144296] RAX: ffffffffffffffda RBX: 00007f3887165f80 RCX: 00007f38870460c9 [ 3402.151554] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 3402.158810] RBP: 00007f38855b81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3402.166080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:15 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_AIE_ON(r1, 0x7001) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:15 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x789540) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x10401, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0xb4, r1, 0x200, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40c0}, 0x1) 09:01:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (fail_nth: 7) [ 3402.173941] R13: 00007ffdf76a3ddf R14: 00007f38855b8300 R15: 0000000000022000 [ 3402.189488] FAULT_INJECTION: forcing a failure. [ 3402.189488] name failslab, interval 1, probability 0, space 0, times 0 [ 3402.212073] CPU: 1 PID: 22637 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:15 executing program 2: bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(r1, 0xee00, 0xffffffffffffffff) [ 3402.219972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3402.229320] Call Trace: [ 3402.231904] dump_stack+0x1b2/0x281 [ 3402.235534] should_fail.cold+0x10a/0x149 [ 3402.239688] should_failslab+0xd6/0x130 [ 3402.243672] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3402.248345] ? blk_mq_can_queue+0x40/0x40 [ 3402.252485] ? queue_set_hctx_shared+0x210/0x210 [ 3402.257237] blk_stat_alloc_callback+0x54/0x2f0 [ 3402.261911] blk_mq_init_allocated_queue+0x80/0xfd0 [ 3402.267939] ? blkcg_init_queue+0x19f/0x410 [ 3402.272257] ? blk_alloc_queue_node+0x82f/0xb40 [ 3402.276922] blk_mq_init_queue+0x5a/0x90 [ 3402.280976] loop_add+0x303/0x830 [ 3402.284425] ? loop_queue_rq+0x280/0x280 [ 3402.288475] ? loop_queue_work+0x21e0/0x21e0 [ 3402.292873] loop_control_ioctl+0x11a/0x3f0 [ 3402.297181] ? loop_lookup+0x190/0x190 [ 3402.301047] ? SyS_write+0x1b7/0x210 [ 3402.304757] ? loop_lookup+0x190/0x190 [ 3402.308623] do_vfs_ioctl+0x75a/0xff0 [ 3402.312404] ? lock_acquire+0x170/0x3f0 [ 3402.316352] ? ioctl_preallocate+0x1a0/0x1a0 [ 3402.320738] ? __fget+0x265/0x3e0 [ 3402.324165] ? do_vfs_ioctl+0xff0/0xff0 [ 3402.328115] ? security_file_ioctl+0x83/0xb0 [ 3402.332496] SyS_ioctl+0x7f/0xb0 [ 3402.335837] ? do_vfs_ioctl+0xff0/0xff0 [ 3402.339790] do_syscall_64+0x1d5/0x640 [ 3402.343656] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3402.348817] RIP: 0033:0x7f0bff8e60c9 [ 3402.352501] RSP: 002b:00007f0bfde37168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3402.360184] RAX: ffffffffffffffda RBX: 00007f0bffa06050 RCX: 00007f0bff8e60c9 [ 3402.367426] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 09:01:15 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 32) [ 3402.374672] RBP: 00007f0bfde371d0 R08: 0000000000000000 R09: 0000000000000000 [ 3402.381918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3402.389161] R13: 00007ffce046c59f R14: 00007f0bfde37300 R15: 0000000000022000 09:01:15 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) (async, rerun: 64) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000200)) (rerun: 64) 09:01:15 executing program 2: bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(r1, 0xee00, 0xffffffffffffffff) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) setresuid(r1, 0xee00, 0xffffffffffffffff) (async) 09:01:15 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x40040, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = socket(0xb, 0x80000, 0x99cf) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000006f4fb5d3a97bab41f25eecc3fd331c12710dc7c1dd0dd7206004137a810100000000000000c7740e445d8c4b3842a89852e366ca82c4ba5924c284dbb7822bb88ecdd007f08c9ccd243dc9e806237634642ab2f915ad8c0cf5175132bfa3f39db791246b07234a78d1b9ad91d97a32ab3f1338d8", @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf250700000005001400020000000500120020000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 09:01:15 executing program 2: bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(r1, 0xee00, 0xffffffffffffffff) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) setresuid(r1, 0xee00, 0xffffffffffffffff) (async) 09:01:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x58, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x200}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xb5}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3402.512398] FAULT_INJECTION: forcing a failure. [ 3402.512398] name failslab, interval 1, probability 0, space 0, times 0 [ 3402.525566] CPU: 1 PID: 22666 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3402.533469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3402.542815] Call Trace: [ 3402.545405] dump_stack+0x1b2/0x281 [ 3402.549039] should_fail.cold+0x10a/0x149 [ 3402.553185] should_failslab+0xd6/0x130 [ 3402.557196] kmem_cache_alloc_node_trace+0x25a/0x400 09:01:15 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3402.562304] __kmalloc_node+0x38/0x70 [ 3402.566110] blk_mq_init_allocated_queue+0x17b/0xfd0 [ 3402.571217] ? blkcg_init_queue+0x19f/0x410 [ 3402.575542] ? blk_alloc_queue_node+0x82f/0xb40 [ 3402.580215] blk_mq_init_queue+0x5a/0x90 [ 3402.584272] loop_add+0x303/0x830 [ 3402.587719] ? loop_queue_rq+0x280/0x280 [ 3402.591772] ? loop_queue_work+0x21e0/0x21e0 [ 3402.596183] loop_control_ioctl+0x11a/0x3f0 [ 3402.600501] ? loop_lookup+0x190/0x190 [ 3402.604383] ? SyS_write+0x1b7/0x210 [ 3402.608088] ? loop_lookup+0x190/0x190 [ 3402.611953] do_vfs_ioctl+0x75a/0xff0 [ 3402.615734] ? lock_acquire+0x170/0x3f0 [ 3402.619687] ? ioctl_preallocate+0x1a0/0x1a0 [ 3402.624072] ? __fget+0x265/0x3e0 [ 3402.627502] ? do_vfs_ioctl+0xff0/0xff0 [ 3402.631461] ? security_file_ioctl+0x83/0xb0 [ 3402.635861] SyS_ioctl+0x7f/0xb0 [ 3402.639217] ? do_vfs_ioctl+0xff0/0xff0 [ 3402.643179] do_syscall_64+0x1d5/0x640 [ 3402.647054] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3402.652229] RIP: 0033:0x7f0bff8e60c9 09:01:16 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x789540) (async) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x10401, 0x0) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0xb4, r1, 0x200, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40c0}, 0x1) 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x58, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x200}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xb5}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:16 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000200)) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) (async) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000200)) (async) [ 3402.655916] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3402.663605] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3402.670852] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3402.678110] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3402.685457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3402.692706] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:16 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 33) 09:01:16 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x40040, 0x0) socket(0x0, 0x80000, 0x9) (async, rerun: 32) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async, rerun: 32) r1 = socket(0xb, 0x80000, 0x99cf) (async, rerun: 64) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) ioctl$UI_ABS_SETUP(r2, 0x401c5504, 0x0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000006f4fb5d3a97bab41f25eecc3fd331c12710dc7c1dd0dd7206004137a810100000000000000c7740e445d8c4b3842a89852e366ca82c4ba5924c284dbb7822bb88ecdd007f08c9ccd243dc9e806237634642ab2f915ad8c0cf5175132bfa3f39db791246b07234a78d1b9ad91d97a32ab3f1338d8", @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf250700000005001400020000000500120020000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 09:01:16 executing program 2: setresuid(0x0, 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) socket$l2tp(0x2, 0x2, 0x73) recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000280)=""/172, 0xac}, {&(0x7f0000000340)=""/38, 0x26}, {&(0x7f0000000380)=""/164, 0xa4}, {&(0x7f0000000440)=""/242, 0xf2}, {&(0x7f0000000540)=""/177, 0xb1}], 0x5, &(0x7f0000000680)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}, 0x22) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x40, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x1}, @acquire_done={0x40106309, 0x2}, @acquire={0x40046305, 0x2}, @increfs_done={0x40106308, 0x1}], 0x74, 0x0, &(0x7f0000000080)="7b33871b678aef66af00ecc46b142c1e08df6b93bedfe867755a42c83e98596701043b8368ee7c882f010400003f45f99efbdc89a70d4cc524bd1e5e50640a961d63c6acf85315e15cd7dad5fbcead5a7b84730c83811f121ed034eac4b24d4508fd9da6fcae021c596f6cc90000000000000000"}) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x98}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x22000000}, 0x1) 09:01:16 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x789540) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x10401, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0xb4, r1, 0x200, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40c0}, 0x1) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x789540) (async) openat$md(0xffffffffffffff9c, &(0x7f0000000000), 0x10401, 0x0) (async) pipe(&(0x7f0000000080)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) (async) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0xb4, r1, 0x200, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40c0}, 0x1) (async) 09:01:16 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x25a1, 0x7}) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000000)) 09:01:16 executing program 2: setresuid(0x0, 0x0, 0x0) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 32) socket$l2tp(0x2, 0x2, 0x73) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000280)=""/172, 0xac}, {&(0x7f0000000340)=""/38, 0x26}, {&(0x7f0000000380)=""/164, 0xa4}, {&(0x7f0000000440)=""/242, 0xf2}, {&(0x7f0000000540)=""/177, 0xb1}], 0x5, &(0x7f0000000680)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}, 0x22) (async, rerun: 64) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x40, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x1}, @acquire_done={0x40106309, 0x2}, @acquire={0x40046305, 0x2}, @increfs_done={0x40106308, 0x1}], 0x74, 0x0, &(0x7f0000000080)="7b33871b678aef66af00ecc46b142c1e08df6b93bedfe867755a42c83e98596701043b8368ee7c882f010400003f45f99efbdc89a70d4cc524bd1e5e50640a961d63c6acf85315e15cd7dad5fbcead5a7b84730c83811f121ed034eac4b24d4508fd9da6fcae021c596f6cc90000000000000000"}) (async, rerun: 64) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x98}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x22000000}, 0x1) [ 3402.845339] FAULT_INJECTION: forcing a failure. [ 3402.845339] name failslab, interval 1, probability 0, space 0, times 0 09:01:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x58, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x200}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xb5}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3402.893556] CPU: 0 PID: 22715 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3402.901473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3402.910821] Call Trace: [ 3402.913408] dump_stack+0x1b2/0x281 [ 3402.917038] should_fail.cold+0x10a/0x149 [ 3402.921186] should_failslab+0xd6/0x130 [ 3402.925158] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3402.930264] __kmalloc_node+0x38/0x70 [ 3402.934337] sbitmap_init_node+0x10c/0x3d0 [ 3402.938580] blk_mq_realloc_hw_ctxs+0x59b/0xe00 [ 3402.943274] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 3402.948372] ? blkcg_init_queue+0x19f/0x410 [ 3402.952692] ? blk_alloc_queue_node+0x82f/0xb40 [ 3402.957365] blk_mq_init_queue+0x5a/0x90 [ 3402.961424] loop_add+0x303/0x830 [ 3402.964878] ? loop_queue_rq+0x280/0x280 [ 3402.968935] ? loop_queue_work+0x21e0/0x21e0 [ 3402.973346] loop_control_ioctl+0x11a/0x3f0 [ 3402.977664] ? loop_lookup+0x190/0x190 [ 3402.981555] ? SyS_write+0x1b7/0x210 [ 3402.985269] ? loop_lookup+0x190/0x190 [ 3402.989155] do_vfs_ioctl+0x75a/0xff0 [ 3402.992973] ? lock_acquire+0x170/0x3f0 [ 3402.996944] ? ioctl_preallocate+0x1a0/0x1a0 [ 3403.001353] ? __fget+0x265/0x3e0 [ 3403.004804] ? do_vfs_ioctl+0xff0/0xff0 [ 3403.008776] ? security_file_ioctl+0x83/0xb0 [ 3403.013183] SyS_ioctl+0x7f/0xb0 [ 3403.016547] ? do_vfs_ioctl+0xff0/0xff0 [ 3403.020524] do_syscall_64+0x1d5/0x640 [ 3403.024413] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3403.029594] RIP: 0033:0x7f0bff8e60c9 [ 3403.033342] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:16 executing program 2: setresuid(0x0, 0x0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) socket$l2tp(0x2, 0x2, 0x73) recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000280)=""/172, 0xac}, {&(0x7f0000000340)=""/38, 0x26}, {&(0x7f0000000380)=""/164, 0xa4}, {&(0x7f0000000440)=""/242, 0xf2}, {&(0x7f0000000540)=""/177, 0xb1}], 0x5, &(0x7f0000000680)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}, 0x22) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x40, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x1}, @acquire_done={0x40106309, 0x2}, @acquire={0x40046305, 0x2}, @increfs_done={0x40106308, 0x1}], 0x74, 0x0, &(0x7f0000000080)="7b33871b678aef66af00ecc46b142c1e08df6b93bedfe867755a42c83e98596701043b8368ee7c882f010400003f45f99efbdc89a70d4cc524bd1e5e50640a961d63c6acf85315e15cd7dad5fbcead5a7b84730c83811f121ed034eac4b24d4508fd9da6fcae021c596f6cc90000000000000000"}) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x98}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x22000000}, 0x1) setresuid(0x0, 0x0, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) socket$l2tp(0x2, 0x2, 0x73) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000280)=""/172, 0xac}, {&(0x7f0000000340)=""/38, 0x26}, {&(0x7f0000000380)=""/164, 0xa4}, {&(0x7f0000000440)=""/242, 0xf2}, {&(0x7f0000000540)=""/177, 0xb1}], 0x5, &(0x7f0000000680)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}, 0x22) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x40, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x1}, @acquire_done={0x40106309, 0x2}, @acquire={0x40046305, 0x2}, @increfs_done={0x40106308, 0x1}], 0x74, 0x0, &(0x7f0000000080)="7b33871b678aef66af00ecc46b142c1e08df6b93bedfe867755a42c83e98596701043b8368ee7c882f010400003f45f99efbdc89a70d4cc524bd1e5e50640a961d63c6acf85315e15cd7dad5fbcead5a7b84730c83811f121ed034eac4b24d4508fd9da6fcae021c596f6cc90000000000000000"}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x98}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x22000000}, 0x1) (async) 09:01:16 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 34) [ 3403.041046] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3403.048309] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3403.055572] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3403.062836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3403.070102] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:16 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x25a1, 0x7}) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000000)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x25a1, 0x7}) (async) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000000)) (async) 09:01:16 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x40040, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = socket(0xb, 0x80000, 0x99cf) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000006f4fb5d3a97bab41f25eecc3fd331c12710dc7c1dd0dd7206004137a810100000000000000c7740e445d8c4b3842a89852e366ca82c4ba5924c284dbb7822bb88ecdd007f08c9ccd243dc9e806237634642ab2f915ad8c0cf5175132bfa3f39db791246b07234a78d1b9ad91d97a32ab3f1338d8", @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf250700000005001400020000000500120020000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x40040, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) socket(0xb, 0x80000, 0x99cf) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$UI_ABS_SETUP(r2, 0x401c5504, 0x0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000006f4fb5d3a97bab41f25eecc3fd331c12710dc7c1dd0dd7206004137a810100000000000000c7740e445d8c4b3842a89852e366ca82c4ba5924c284dbb7822bb88ecdd007f08c9ccd243dc9e806237634642ab2f915ad8c0cf5175132bfa3f39db791246b07234a78d1b9ad91d97a32ab3f1338d8", @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf250700000005001400020000000500120020000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) (async) 09:01:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES16=r2, @ANYRESOCT=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:16 executing program 1: syz_open_dev$loop(&(0x7f0000000000), 0x500000000000802, 0x8a002) [ 3403.176370] FAULT_INJECTION: forcing a failure. [ 3403.176370] name failslab, interval 1, probability 0, space 0, times 0 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) [ 3403.248750] CPU: 1 PID: 22765 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3403.256653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3403.265999] Call Trace: [ 3403.268606] dump_stack+0x1b2/0x281 [ 3403.272231] should_fail.cold+0x10a/0x149 [ 3403.276375] should_failslab+0xd6/0x130 [ 3403.280348] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3403.285442] __kmalloc_node+0x38/0x70 [ 3403.289243] blk_mq_realloc_hw_ctxs+0x1a5/0xe00 [ 3403.293910] ? rcu_read_lock_sched_held+0x16c/0x1d0 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 64) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (rerun: 64) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:16 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = getuid() setresuid(0x0, r0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r1 = getuid() setresuid(r1, 0xee01, r0) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000080)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x2, 0x0) prctl$PR_GET_DUMPABLE(0x3) [ 3403.298960] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 3403.304240] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 3403.309343] ? blkcg_init_queue+0x19f/0x410 [ 3403.313669] ? blk_alloc_queue_node+0x82f/0xb40 [ 3403.318339] blk_mq_init_queue+0x5a/0x90 [ 3403.322394] loop_add+0x303/0x830 [ 3403.325839] ? loop_queue_rq+0x280/0x280 [ 3403.329896] ? loop_queue_work+0x21e0/0x21e0 [ 3403.334302] loop_control_ioctl+0x11a/0x3f0 [ 3403.338619] ? loop_lookup+0x190/0x190 [ 3403.342510] ? SyS_write+0x1b7/0x210 09:01:16 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r0 = getuid() setresuid(0x0, r0, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r1 = getuid() setresuid(r1, 0xee01, r0) (async) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000080)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x2, 0x0) (async) prctl$PR_GET_DUMPABLE(0x3) [ 3403.346222] ? loop_lookup+0x190/0x190 [ 3403.350107] do_vfs_ioctl+0x75a/0xff0 [ 3403.353900] ? lock_acquire+0x170/0x3f0 [ 3403.357869] ? ioctl_preallocate+0x1a0/0x1a0 [ 3403.362279] ? __fget+0x265/0x3e0 [ 3403.365737] ? do_vfs_ioctl+0xff0/0xff0 [ 3403.369709] ? security_file_ioctl+0x83/0xb0 [ 3403.374116] SyS_ioctl+0x7f/0xb0 [ 3403.377476] ? do_vfs_ioctl+0xff0/0xff0 [ 3403.381450] do_syscall_64+0x1d5/0x640 [ 3403.385335] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3403.390515] RIP: 0033:0x7f0bff8e60c9 09:01:16 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r0 = getuid() setresuid(0x0, r0, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r1 = getuid() setresuid(r1, 0xee01, r0) (async) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000080)) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x2, 0x0) (async) prctl$PR_GET_DUMPABLE(0x3) 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc040564b, &(0x7f0000000080)={0xffff, 0x0, 0x700e, 0x9, 0xda3, {0x4, 0x9}, 0x1}) [ 3403.394214] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3403.401916] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3403.409179] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3403.416440] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3403.423811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3403.431058] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:16 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 35) 09:01:16 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x25a1, 0x7}) (async) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000000)) 09:01:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES16=r2, @ANYRESOCT=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES16=r2, @ANYRESOCT=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (async) 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc040564b, &(0x7f0000000080)={0xffff, 0x0, 0x700e, 0x9, 0xda3, {0x4, 0x9}, 0x1}) 09:01:16 executing program 1: syz_open_dev$loop(&(0x7f0000000000), 0x500000000000802, 0x8a002) syz_open_dev$loop(&(0x7f0000000000), 0x500000000000802, 0x8a002) (async) 09:01:16 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) socket(0x0, 0x80000, 0x9) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xaa}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7b}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r4}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x810}, 0x40841) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x2) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc040564b, &(0x7f0000000080)={0xffff, 0x0, 0x700e, 0x9, 0xda3, {0x4, 0x9}, 0x1}) [ 3403.575821] FAULT_INJECTION: forcing a failure. [ 3403.575821] name failslab, interval 1, probability 0, space 0, times 0 [ 3403.623168] CPU: 1 PID: 22826 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3403.631079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3403.640427] Call Trace: [ 3403.643017] dump_stack+0x1b2/0x281 [ 3403.646648] should_fail.cold+0x10a/0x149 [ 3403.650794] should_failslab+0xd6/0x130 [ 3403.654767] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3403.659880] __kmalloc_node+0x38/0x70 [ 3403.663680] blk_alloc_flush_queue+0xf7/0x2b0 [ 3403.668175] blk_mq_realloc_hw_ctxs+0x6ab/0xe00 [ 3403.672851] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 3403.677960] ? blkcg_init_queue+0x19f/0x410 [ 3403.682277] ? blk_alloc_queue_node+0x82f/0xb40 [ 3403.686943] blk_mq_init_queue+0x5a/0x90 [ 3403.690999] loop_add+0x303/0x830 [ 3403.694447] ? loop_queue_rq+0x280/0x280 [ 3403.698499] ? loop_queue_work+0x21e0/0x21e0 [ 3403.702906] loop_control_ioctl+0x11a/0x3f0 [ 3403.707235] ? loop_lookup+0x190/0x190 [ 3403.711122] ? SyS_write+0x1b7/0x210 [ 3403.714833] ? loop_lookup+0x190/0x190 [ 3403.718716] do_vfs_ioctl+0x75a/0xff0 [ 3403.722517] ? lock_acquire+0x170/0x3f0 [ 3403.726494] ? ioctl_preallocate+0x1a0/0x1a0 [ 3403.730929] ? __fget+0x265/0x3e0 [ 3403.734381] ? do_vfs_ioctl+0xff0/0xff0 [ 3403.738351] ? security_file_ioctl+0x83/0xb0 [ 3403.742758] SyS_ioctl+0x7f/0xb0 [ 3403.746118] ? do_vfs_ioctl+0xff0/0xff0 [ 3403.750079] do_syscall_64+0x1d5/0x640 [ 3403.753958] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3403.759144] RIP: 0033:0x7f0bff8e60c9 [ 3403.762848] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:16 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000080)=""/174, 0xae}, {&(0x7f0000000000)=""/38, 0x26}, {&(0x7f0000000140)=""/4096, 0x1000}, {&(0x7f0000001140)=""/125, 0x7d}, {&(0x7f00000011c0)=""/143, 0x8f}], 0x5, &(0x7f0000001300)=[@rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x6000) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000080)=""/174, 0xae}, {&(0x7f0000000000)=""/38, 0x26}, {&(0x7f0000000140)=""/4096, 0x1000}, {&(0x7f0000001140)=""/125, 0x7d}, {&(0x7f00000011c0)=""/143, 0x8f}], 0x5, &(0x7f0000001300)=[@rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x6000) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (rerun: 32) 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000080)=""/174, 0xae}, {&(0x7f0000000000)=""/38, 0x26}, {&(0x7f0000000140)=""/4096, 0x1000}, {&(0x7f0000001140)=""/125, 0x7d}, {&(0x7f00000011c0)=""/143, 0x8f}], 0x5, &(0x7f0000001300)=[@rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}, 0x6000) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_TMR_METRONOME(r1, 0x40045407) r2 = getuid() r3 = getuid() r4 = getuid() getuid() setresuid(r3, r4, 0xee00) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) ioctl$VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000180)=@overlay={0x84a, 0x5, 0x4, 0xe000, 0x3ff80, {0x0, 0xea60}, {0x3, 0xc, 0xff, 0x7f, 0x81, 0x3f, "5044f656"}, 0x7, 0x3, {}, 0x5, 0x0, r1}) r6 = getuid() r7 = getuid() setresuid(r6, r7, 0xee00) setresuid(r0, r2, r6) getuid() r8 = getuid() r9 = getuid() setresuid(r8, r9, 0xee00) ioctl$RTC_WKALM_SET(r5, 0x4028700f, &(0x7f0000000240)={0x0, 0x0, {0x21, 0x32, 0x4, 0x10, 0x3, 0x0, 0x5, 0x14c}}) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), 0xffffffffffffffff) setresuid(0xee00, r8, 0xee00) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)=0x0) setresuid(r3, r2, r10) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/custom0\x00', 0x800, 0x0) 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = getuid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_TMR_METRONOME(r1, 0x40045407) r2 = getuid() (async) r3 = getuid() (async) r4 = getuid() (async) getuid() setresuid(r3, r4, 0xee00) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) ioctl$VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000180)=@overlay={0x84a, 0x5, 0x4, 0xe000, 0x3ff80, {0x0, 0xea60}, {0x3, 0xc, 0xff, 0x7f, 0x81, 0x3f, "5044f656"}, 0x7, 0x3, {}, 0x5, 0x0, r1}) (async) r6 = getuid() (async) r7 = getuid() setresuid(r6, r7, 0xee00) (async) setresuid(r0, r2, r6) getuid() r8 = getuid() r9 = getuid() setresuid(r8, r9, 0xee00) (async) ioctl$RTC_WKALM_SET(r5, 0x4028700f, &(0x7f0000000240)={0x0, 0x0, {0x21, 0x32, 0x4, 0x10, 0x3, 0x0, 0x5, 0x14c}}) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), 0xffffffffffffffff) setresuid(0xee00, r8, 0xee00) (async) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)=0x0) setresuid(r3, r2, r10) (async) getuid() mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/custom0\x00', 0x800, 0x0) [ 3403.770555] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3403.777824] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3403.785094] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3403.792359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3403.799631] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:17 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 36) 09:01:17 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x1de, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x24800) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0), 0x4) syz_open_dev$loop(&(0x7f0000000080), 0x3ff, 0x80840) 09:01:17 executing program 1: syz_open_dev$loop(&(0x7f0000000000), 0x500000000000802, 0x8a002) 09:01:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES16=r2, @ANYRESOCT=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 32) r0 = getuid() (async, rerun: 32) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_TMR_METRONOME(r1, 0x40045407) (async) r2 = getuid() r3 = getuid() (async, rerun: 64) r4 = getuid() (rerun: 64) getuid() (async) setresuid(r3, r4, 0xee00) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r5) (async) ioctl$VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000180)=@overlay={0x84a, 0x5, 0x4, 0xe000, 0x3ff80, {0x0, 0xea60}, {0x3, 0xc, 0xff, 0x7f, 0x81, 0x3f, "5044f656"}, 0x7, 0x3, {}, 0x5, 0x0, r1}) (async, rerun: 64) r6 = getuid() (rerun: 64) r7 = getuid() setresuid(r6, r7, 0xee00) (async, rerun: 32) setresuid(r0, r2, r6) (async, rerun: 32) getuid() (async) r8 = getuid() (async) r9 = getuid() setresuid(r8, r9, 0xee00) (async) ioctl$RTC_WKALM_SET(r5, 0x4028700f, &(0x7f0000000240)={0x0, 0x0, {0x21, 0x32, 0x4, 0x10, 0x3, 0x0, 0x5, 0x14c}}) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), 0xffffffffffffffff) setresuid(0xee00, r8, 0xee00) (async) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)=0x0) setresuid(r3, r2, r10) getuid() (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/custom0\x00', 0x800, 0x0) 09:01:17 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) socket(0x0, 0x80000, 0x9) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xaa}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7b}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r4}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x810}, 0x40841) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x2) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) 09:01:17 executing program 1: syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x240000) write$yama_ptrace_scope(0xffffffffffffffff, &(0x7f0000000000)='3\x00', 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) connect$unix(r1, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_TMR_METRONOME(r0, 0x40045407) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x512) 09:01:17 executing program 2: ioctl$NBD_SET_FLAGS(0xffffffffffffffff, 0xab0a, 0x1) setresuid(0x0, 0xee01, 0x0) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000000)={0x0, 0x9, 0x3, 0x40, 0xc0f, 0x8001, 0x1}) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:17 executing program 2: ioctl$NBD_SET_FLAGS(0xffffffffffffffff, 0xab0a, 0x1) setresuid(0x0, 0xee01, 0x0) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000000)={0x0, 0x9, 0x3, 0x40, 0xc0f, 0x8001, 0x1}) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3403.929963] FAULT_INJECTION: forcing a failure. [ 3403.929963] name failslab, interval 1, probability 0, space 0, times 0 [ 3403.946934] CPU: 1 PID: 22880 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3403.954840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3403.964290] Call Trace: [ 3403.966883] dump_stack+0x1b2/0x281 [ 3403.970516] should_fail.cold+0x10a/0x149 [ 3403.974668] should_failslab+0xd6/0x130 09:01:17 executing program 2: ioctl$NBD_SET_FLAGS(0xffffffffffffffff, 0xab0a, 0x1) (async) setresuid(0x0, 0xee01, 0x0) (async, rerun: 64) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000000)={0x0, 0x9, 0x3, 0x40, 0xc0f, 0x8001, 0x1}) (async, rerun: 64) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3403.978649] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3403.983759] blk_mq_init_tags+0x5e/0x280 [ 3403.987825] blk_mq_alloc_rq_map+0x90/0x220 [ 3403.992149] blk_mq_sched_alloc_tags+0xaa/0x240 [ 3403.996823] blk_mq_init_sched+0x18d/0x4a0 [ 3404.001059] ? _raw_spin_unlock+0x29/0x40 [ 3404.005219] elevator_init+0x2ee/0x410 [ 3404.009106] blk_mq_sched_init+0x28/0x40 [ 3404.013166] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3404.018257] blk_mq_init_queue+0x5a/0x90 [ 3404.022301] loop_add+0x303/0x830 [ 3404.025729] ? loop_queue_rq+0x280/0x280 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000240)={&(0x7f00000000c0), 0x6e, &(0x7f0000000140), 0x0, &(0x7f0000000180)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}, 0x21) [ 3404.029767] ? loop_queue_work+0x21e0/0x21e0 [ 3404.034590] loop_control_ioctl+0x11a/0x3f0 [ 3404.038890] ? loop_lookup+0x190/0x190 [ 3404.042764] ? SyS_write+0x1b7/0x210 [ 3404.046477] ? loop_lookup+0x190/0x190 [ 3404.050360] do_vfs_ioctl+0x75a/0xff0 [ 3404.054148] ? lock_acquire+0x170/0x3f0 [ 3404.058110] ? ioctl_preallocate+0x1a0/0x1a0 [ 3404.062507] ? __fget+0x265/0x3e0 [ 3404.065948] ? do_vfs_ioctl+0xff0/0xff0 [ 3404.069916] ? security_file_ioctl+0x83/0xb0 [ 3404.074324] SyS_ioctl+0x7f/0xb0 [ 3404.077685] ? do_vfs_ioctl+0xff0/0xff0 [ 3404.081660] do_syscall_64+0x1d5/0x640 [ 3404.085543] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3404.090706] RIP: 0033:0x7f0bff8e60c9 [ 3404.094395] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3404.102079] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3404.109324] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3404.116574] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 09:01:17 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 37) [ 3404.123825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3404.131087] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:17 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x1de, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x24800) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0), 0x4) syz_open_dev$loop(&(0x7f0000000080), 0x3ff, 0x80840) syz_open_dev$loop(&(0x7f0000000040), 0x1de, 0x0) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x24800) (async) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0), 0x4) (async) syz_open_dev$loop(&(0x7f0000000080), 0x3ff, 0x80840) (async) 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000240)={&(0x7f00000000c0), 0x6e, &(0x7f0000000140), 0x0, &(0x7f0000000180)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}, 0x21) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r0, &(0x7f0000000240)={&(0x7f00000000c0), 0x6e, &(0x7f0000000140), 0x0, &(0x7f0000000180)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}, 0x21) (async) 09:01:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) 09:01:17 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) socket(0x0, 0x80000, 0x9) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r4) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xaa}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7b}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r4}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x810}, 0x40841) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x2) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) 09:01:17 executing program 1: syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x240000) write$yama_ptrace_scope(0xffffffffffffffff, &(0x7f0000000000)='3\x00', 0x2) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) connect$unix(r1, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_TMR_METRONOME(r0, 0x40045407) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x512) syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x240000) (async) write$yama_ptrace_scope(0xffffffffffffffff, &(0x7f0000000000)='3\x00', 0x2) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) connect$unix(r1, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) (async) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) (async) pipe(&(0x7f0000000ac0)) (async) ioctl$SNDCTL_TMR_METRONOME(r0, 0x40045407) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x512) (async) [ 3404.296463] FAULT_INJECTION: forcing a failure. [ 3404.296463] name failslab, interval 1, probability 0, space 0, times 0 [ 3404.330376] CPU: 0 PID: 22920 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3404.338283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3404.347628] Call Trace: [ 3404.350214] dump_stack+0x1b2/0x281 [ 3404.353835] should_fail.cold+0x10a/0x149 [ 3404.357974] should_failslab+0xd6/0x130 [ 3404.361939] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3404.367020] __kmalloc_node+0x38/0x70 [ 3404.370798] blk_alloc_flush_queue+0xf7/0x2b0 [ 3404.375271] blk_mq_realloc_hw_ctxs+0x6ab/0xe00 [ 3404.379937] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 3404.385146] ? blkcg_init_queue+0x19f/0x410 [ 3404.389471] ? blk_alloc_queue_node+0x82f/0xb40 [ 3404.394122] blk_mq_init_queue+0x5a/0x90 [ 3404.398171] loop_add+0x303/0x830 [ 3404.401611] ? loop_queue_rq+0x280/0x280 [ 3404.405653] ? loop_queue_work+0x21e0/0x21e0 [ 3404.410053] loop_control_ioctl+0x11a/0x3f0 [ 3404.414359] ? loop_lookup+0x190/0x190 [ 3404.418235] ? SyS_write+0x1b7/0x210 [ 3404.421937] ? loop_lookup+0x190/0x190 [ 3404.425803] do_vfs_ioctl+0x75a/0xff0 [ 3404.429581] ? lock_acquire+0x170/0x3f0 [ 3404.433543] ? ioctl_preallocate+0x1a0/0x1a0 [ 3404.437952] ? __fget+0x265/0x3e0 [ 3404.441399] ? do_vfs_ioctl+0xff0/0xff0 [ 3404.445369] ? security_file_ioctl+0x83/0xb0 [ 3404.449773] SyS_ioctl+0x7f/0xb0 [ 3404.453116] ? do_vfs_ioctl+0xff0/0xff0 [ 3404.457074] do_syscall_64+0x1d5/0x640 [ 3404.460948] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3404.466112] RIP: 0033:0x7f0bff8e60c9 [ 3404.469803] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3404.477507] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3404.484768] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 09:01:17 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) (async) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000240)={&(0x7f00000000c0), 0x6e, &(0x7f0000000140), 0x0, &(0x7f0000000180)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}, 0x21) 09:01:17 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 38) [ 3404.492021] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3404.499275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3404.506525] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:17 executing program 1: syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x240000) write$yama_ptrace_scope(0xffffffffffffffff, &(0x7f0000000000)='3\x00', 0x2) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) connect$unix(r1, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) (async) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_TMR_METRONOME(r0, 0x40045407) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x512) 09:01:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:17 executing program 2: r0 = syz_open_dev$rtc(&(0x7f00000000c0), 0x68e1, 0x400200) ioctl$RTC_VL_CLR(r0, 0x7014) setresuid(0x0, 0xee01, 0x0) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, &(0x7f0000000000)=0x2) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f0000000080)=0xffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000100)=0x4) 09:01:17 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:17 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x1de, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async, rerun: 32) syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x24800) (rerun: 32) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0), 0x4) syz_open_dev$loop(&(0x7f0000000080), 0x3ff, 0x80840) 09:01:17 executing program 2: r0 = syz_open_dev$rtc(&(0x7f00000000c0), 0x68e1, 0x400200) ioctl$RTC_VL_CLR(r0, 0x7014) setresuid(0x0, 0xee01, 0x0) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, &(0x7f0000000000)=0x2) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f0000000080)=0xffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000100)=0x4) syz_open_dev$rtc(&(0x7f00000000c0), 0x68e1, 0x400200) (async) ioctl$RTC_VL_CLR(r0, 0x7014) (async) setresuid(0x0, 0xee01, 0x0) (async) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, &(0x7f0000000000)=0x2) (async) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f0000000080)=0xffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000100)=0x4) (async) 09:01:17 executing program 2: r0 = syz_open_dev$rtc(&(0x7f00000000c0), 0x68e1, 0x400200) ioctl$RTC_VL_CLR(r0, 0x7014) (async) setresuid(0x0, 0xee01, 0x0) (async) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, &(0x7f0000000000)=0x2) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f0000000080)=0xffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000100)=0x4) 09:01:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3404.633153] FAULT_INJECTION: forcing a failure. [ 3404.633153] name failslab, interval 1, probability 0, space 0, times 0 [ 3404.646166] CPU: 0 PID: 22965 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3404.654051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3404.663397] Call Trace: [ 3404.665985] dump_stack+0x1b2/0x281 [ 3404.669618] should_fail.cold+0x10a/0x149 [ 3404.673768] should_failslab+0xd6/0x130 [ 3404.677743] kmem_cache_alloc_node_trace+0x25a/0x400 09:01:18 executing program 2: setresuid(0x0, 0xee01, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000080)) 09:01:18 executing program 2: setresuid(0x0, 0xee01, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000080)) setresuid(0x0, 0xee01, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000080)) (async) [ 3404.682848] __kmalloc_node+0x38/0x70 [ 3404.686650] blk_alloc_flush_queue+0xf7/0x2b0 [ 3404.691162] blk_mq_realloc_hw_ctxs+0x6ab/0xe00 [ 3404.695845] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 3404.700944] ? blkcg_init_queue+0x19f/0x410 [ 3404.705265] ? blk_alloc_queue_node+0x82f/0xb40 [ 3404.709931] blk_mq_init_queue+0x5a/0x90 [ 3404.713985] loop_add+0x303/0x830 [ 3404.717429] ? loop_queue_rq+0x280/0x280 [ 3404.721504] ? loop_queue_work+0x21e0/0x21e0 [ 3404.725904] loop_control_ioctl+0x11a/0x3f0 09:01:18 executing program 2: setresuid(0x0, 0xee01, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000080)) setresuid(0x0, 0xee01, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000080)) (async) [ 3404.730222] ? loop_lookup+0x190/0x190 [ 3404.734101] ? SyS_write+0x1b7/0x210 [ 3404.737810] ? loop_lookup+0x190/0x190 [ 3404.741690] do_vfs_ioctl+0x75a/0xff0 [ 3404.745573] ? lock_acquire+0x170/0x3f0 [ 3404.749551] ? ioctl_preallocate+0x1a0/0x1a0 [ 3404.753961] ? __fget+0x265/0x3e0 [ 3404.757411] ? do_vfs_ioctl+0xff0/0xff0 [ 3404.761402] ? security_file_ioctl+0x83/0xb0 [ 3404.765807] SyS_ioctl+0x7f/0xb0 [ 3404.769170] ? do_vfs_ioctl+0xff0/0xff0 [ 3404.773142] do_syscall_64+0x1d5/0x640 [ 3404.777028] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 09:01:18 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 39) [ 3404.782206] RIP: 0033:0x7f0bff8e60c9 [ 3404.785899] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3404.793588] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3404.800844] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3404.808092] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3404.815341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3404.822596] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:18 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 09:01:18 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) bind$unix(r0, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e23}, 0x6e) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) recvmsg$unix(r1, &(0x7f0000001640)={&(0x7f0000000380), 0x6e, &(0x7f00000015c0)=[{&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f0000001400)=""/143, 0x8f}, {&(0x7f00000014c0)=""/190, 0xbe}, {&(0x7f0000001580)=""/63, 0x3f}], 0x4, &(0x7f0000001600)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000db9eb90000", @ANYRES32, @ANYRES32], 0x38}, 0x2001) pipe(&(0x7f0000000000)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000180)={&(0x7f0000000080), 0x6e, &(0x7f0000000300)=[{&(0x7f0000000100)=""/1, 0x1}, {&(0x7f0000000140)=""/48, 0x30}, {&(0x7f00000001c0)=""/241, 0xf1}, {&(0x7f0000001680)=""/61, 0x3d}], 0x4}, 0x10020) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2\x00', 0x1ff) 09:01:18 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) socket(0x2, 0x4, 0x1f) 09:01:18 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES32=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3404.921709] FAULT_INJECTION: forcing a failure. [ 3404.921709] name failslab, interval 1, probability 0, space 0, times 0 [ 3404.942592] CPU: 1 PID: 23016 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3404.950490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3404.959845] Call Trace: [ 3404.962447] dump_stack+0x1b2/0x281 [ 3404.966073] should_fail.cold+0x10a/0x149 [ 3404.970220] should_failslab+0xd6/0x130 [ 3404.974196] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3404.979308] blk_mq_init_tags+0x5e/0x280 [ 3404.983371] blk_mq_alloc_rq_map+0x90/0x220 [ 3404.987695] blk_mq_sched_alloc_tags+0xaa/0x240 [ 3404.992368] blk_mq_init_sched+0x18d/0x4a0 [ 3404.996601] ? _raw_spin_unlock+0x29/0x40 [ 3405.000741] elevator_init+0x2ee/0x410 [ 3405.004608] blk_mq_sched_init+0x28/0x40 [ 3405.008650] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3405.013739] blk_mq_init_queue+0x5a/0x90 [ 3405.017786] loop_add+0x303/0x830 [ 3405.021266] ? loop_queue_rq+0x280/0x280 [ 3405.025321] ? loop_queue_work+0x21e0/0x21e0 [ 3405.029732] loop_control_ioctl+0x11a/0x3f0 [ 3405.034045] ? loop_lookup+0x190/0x190 [ 3405.037917] ? SyS_write+0x1b7/0x210 [ 3405.041618] ? loop_lookup+0x190/0x190 [ 3405.045489] do_vfs_ioctl+0x75a/0xff0 [ 3405.049275] ? lock_acquire+0x170/0x3f0 [ 3405.053242] ? ioctl_preallocate+0x1a0/0x1a0 [ 3405.057638] ? __fget+0x265/0x3e0 [ 3405.061067] ? do_vfs_ioctl+0xff0/0xff0 [ 3405.065017] ? security_file_ioctl+0x83/0xb0 [ 3405.069399] SyS_ioctl+0x7f/0xb0 [ 3405.072740] ? do_vfs_ioctl+0xff0/0xff0 [ 3405.076696] do_syscall_64+0x1d5/0x640 [ 3405.080570] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3405.085745] RIP: 0033:0x7f0bff8e60c9 [ 3405.089437] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3405.097124] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3405.104368] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3405.111611] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 09:01:18 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs\x00', 0x1ff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) bind$unix(r0, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e23}, 0x6e) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) recvmsg$unix(r1, &(0x7f0000001640)={&(0x7f0000000380), 0x6e, &(0x7f00000015c0)=[{&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f0000001400)=""/143, 0x8f}, {&(0x7f00000014c0)=""/190, 0xbe}, {&(0x7f0000001580)=""/63, 0x3f}], 0x4, &(0x7f0000001600)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000db9eb90000", @ANYRES32, @ANYRES32], 0x38}, 0x2001) (async, rerun: 32) pipe(&(0x7f0000000000)={0xffffffffffffffff}) (rerun: 32) recvmsg$unix(r2, &(0x7f0000000180)={&(0x7f0000000080), 0x6e, &(0x7f0000000300)=[{&(0x7f0000000100)=""/1, 0x1}, {&(0x7f0000000140)=""/48, 0x30}, {&(0x7f00000001c0)=""/241, 0xf1}, {&(0x7f0000001680)=""/61, 0x3d}], 0x4}, 0x10020) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2\x00', 0x1ff) 09:01:18 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 40) 09:01:18 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket(0x0, 0x80000, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="ebffffffff7658c1082008"], 0x1c}}, 0x0) [ 3405.118853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3405.126099] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:18 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) (async) socket(0x2, 0x4, 0x1f) 09:01:18 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs\x00', 0x1ff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) bind$unix(r0, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e23}, 0x6e) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) recvmsg$unix(r1, &(0x7f0000001640)={&(0x7f0000000380), 0x6e, &(0x7f00000015c0)=[{&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f0000001400)=""/143, 0x8f}, {&(0x7f00000014c0)=""/190, 0xbe}, {&(0x7f0000001580)=""/63, 0x3f}], 0x4, &(0x7f0000001600)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000db9eb90000", @ANYRES32, @ANYRES32], 0x38}, 0x2001) (async, rerun: 32) pipe(&(0x7f0000000000)={0xffffffffffffffff}) (rerun: 32) recvmsg$unix(r2, &(0x7f0000000180)={&(0x7f0000000080), 0x6e, &(0x7f0000000300)=[{&(0x7f0000000100)=""/1, 0x1}, {&(0x7f0000000140)=""/48, 0x30}, {&(0x7f00000001c0)=""/241, 0xf1}, {&(0x7f0000001680)=""/61, 0x3d}], 0x4}, 0x10020) (async, rerun: 32) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2\x00', 0x1ff) (rerun: 32) 09:01:18 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 09:01:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="ebffffffff7658c1082008"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="ebffffffff7658c1082008"], 0x1c}}, 0x0) (async) [ 3405.274671] FAULT_INJECTION: forcing a failure. [ 3405.274671] name failslab, interval 1, probability 0, space 0, times 0 [ 3405.298818] CPU: 0 PID: 23054 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3405.306719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3405.316065] Call Trace: [ 3405.318653] dump_stack+0x1b2/0x281 09:01:18 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) setresuid(r2, r1, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:18 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) setresuid(r2, r1, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) setresuid(r2, r1, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) [ 3405.322281] should_fail.cold+0x10a/0x149 [ 3405.326435] should_failslab+0xd6/0x130 [ 3405.330410] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3405.335527] sbitmap_queue_init_node+0x27f/0x5d0 [ 3405.340980] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 3405.346257] blk_mq_init_tags+0xf4/0x280 [ 3405.350320] blk_mq_alloc_rq_map+0x90/0x220 [ 3405.354649] blk_mq_sched_alloc_tags+0xaa/0x240 [ 3405.359330] blk_mq_init_sched+0x18d/0x4a0 [ 3405.363566] ? _raw_spin_unlock+0x29/0x40 [ 3405.367713] elevator_init+0x2ee/0x410 09:01:18 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) (async, rerun: 64) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) (rerun: 64) setresuid(r2, r1, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3405.371599] blk_mq_sched_init+0x28/0x40 [ 3405.375664] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3405.380781] blk_mq_init_queue+0x5a/0x90 [ 3405.384839] loop_add+0x303/0x830 [ 3405.388290] ? loop_queue_rq+0x280/0x280 [ 3405.392344] ? loop_queue_work+0x21e0/0x21e0 [ 3405.396749] loop_control_ioctl+0x11a/0x3f0 [ 3405.401070] ? loop_lookup+0x190/0x190 [ 3405.404964] ? SyS_write+0x1b7/0x210 [ 3405.408674] ? loop_lookup+0x190/0x190 [ 3405.412582] do_vfs_ioctl+0x75a/0xff0 [ 3405.416381] ? lock_acquire+0x170/0x3f0 [ 3405.420382] ? ioctl_preallocate+0x1a0/0x1a0 09:01:18 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(0x0, 0xee01, r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000000)=0x80000001) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3405.424816] ? __fget+0x265/0x3e0 [ 3405.428272] ? do_vfs_ioctl+0xff0/0xff0 [ 3405.432242] ? security_file_ioctl+0x83/0xb0 [ 3405.436650] SyS_ioctl+0x7f/0xb0 [ 3405.440011] ? do_vfs_ioctl+0xff0/0xff0 [ 3405.443980] do_syscall_64+0x1d5/0x640 [ 3405.447868] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3405.453055] RIP: 0033:0x7f0bff8e60c9 [ 3405.456758] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3405.464468] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 09:01:18 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async, rerun: 32) setresuid(0x0, 0xee01, r1) (async, rerun: 32) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000000)=0x80000001) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:18 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 41) 09:01:18 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) socket(0x0, 0x80000, 0x9) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x119001, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:18 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) (async) socket(0x2, 0x4, 0x1f) 09:01:18 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) (async) [ 3405.471837] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3405.479104] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3405.486367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3405.493624] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:18 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) setresuid(0x0, 0xee01, r1) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000000)=0x80000001) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getuid() (async) getuid() (async) setresuid(r0, r1, 0xee00) (async) setresuid(0x0, 0xee01, r1) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000000)=0x80000001) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="ebffffffff7658c1082008"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="ebffffffff7658c1082008"], 0x1c}}, 0x0) (async) [ 3405.634319] FAULT_INJECTION: forcing a failure. [ 3405.634319] name failslab, interval 1, probability 0, space 0, times 0 [ 3405.654864] CPU: 1 PID: 23106 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3405.662757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3405.672092] Call Trace: [ 3405.674661] dump_stack+0x1b2/0x281 [ 3405.678269] should_fail.cold+0x10a/0x149 [ 3405.682396] should_failslab+0xd6/0x130 [ 3405.686367] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3405.691463] __kmalloc_node+0x38/0x70 [ 3405.695243] blk_mq_alloc_rq_map+0x113/0x220 [ 3405.699628] blk_mq_sched_alloc_tags+0xaa/0x240 [ 3405.704273] blk_mq_init_sched+0x18d/0x4a0 [ 3405.708483] ? _raw_spin_unlock+0x29/0x40 [ 3405.712607] elevator_init+0x2ee/0x410 [ 3405.716498] blk_mq_sched_init+0x28/0x40 [ 3405.720566] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3405.725649] blk_mq_init_queue+0x5a/0x90 [ 3405.729688] loop_add+0x303/0x830 [ 3405.733117] ? loop_queue_rq+0x280/0x280 [ 3405.737153] ? loop_queue_work+0x21e0/0x21e0 [ 3405.741537] loop_control_ioctl+0x11a/0x3f0 [ 3405.745837] ? loop_lookup+0x190/0x190 [ 3405.749699] ? SyS_write+0x1b7/0x210 [ 3405.753389] ? loop_lookup+0x190/0x190 [ 3405.757250] do_vfs_ioctl+0x75a/0xff0 [ 3405.761025] ? lock_acquire+0x170/0x3f0 [ 3405.764982] ? ioctl_preallocate+0x1a0/0x1a0 [ 3405.769367] ? __fget+0x265/0x3e0 [ 3405.772808] ? do_vfs_ioctl+0xff0/0xff0 [ 3405.776772] ? security_file_ioctl+0x83/0xb0 [ 3405.781168] SyS_ioctl+0x7f/0xb0 [ 3405.784507] ? do_vfs_ioctl+0xff0/0xff0 [ 3405.788466] do_syscall_64+0x1d5/0x640 [ 3405.792340] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3405.797505] RIP: 0033:0x7f0bff8e60c9 [ 3405.801212] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3405.808902] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3405.816152] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3405.823401] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000240)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x3ff, &(0x7f0000000200)={&(0x7f00000001c0)}}, 0x18) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) 09:01:19 executing program 5: sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:19 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) (async) socket(0x0, 0x80000, 0x9) (async) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x119001, 0x0) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000080)={0x1f}, 0x4) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000240)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x3ff, &(0x7f0000000200)={&(0x7f00000001c0)}}, 0x18) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) 09:01:19 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 42) [ 3405.830649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3405.838242] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:19 executing program 5: sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x0) (async, rerun: 32) r0 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x1, 0x80002) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000180)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000080)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYRES8=r0]) 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) set_robust_list(&(0x7f0000000240)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x3ff, &(0x7f0000000200)={&(0x7f00000001c0)}}, 0x18) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() r1 = getuid() setresuid(r0, r0, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) setresuid(r0, r2, r0) 09:01:19 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xb) (async, rerun: 32) socket(0x0, 0x80000, 0x9) (async, rerun: 32) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x119001, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000080)={0x1f}, 0x4) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000000)) (async) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000080)={0x1f}, 0x4) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) (async) 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = getuid() (async) r1 = getuid() setresuid(r0, r0, r1) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) setresuid(r0, r2, r0) 09:01:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x1, 0x80002) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000180)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000080)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYRES8=r0]) syz_open_dev$loop(&(0x7f0000000040), 0x1, 0x80002) (async) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000180)) (async) pipe(&(0x7f0000000000)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000080)={0xbe, 0x0, 0x1}) (async) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYRES8=r0]) (async) 09:01:19 executing program 5: sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000080)={0x1f}, 0x4) (async) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) [ 3406.093630] FAULT_INJECTION: forcing a failure. [ 3406.093630] name failslab, interval 1, probability 0, space 0, times 0 [ 3406.109586] CPU: 0 PID: 23167 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3406.117482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3406.126826] Call Trace: [ 3406.129427] dump_stack+0x1b2/0x281 [ 3406.133231] should_fail.cold+0x10a/0x149 [ 3406.137403] should_failslab+0xd6/0x130 [ 3406.141380] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3406.146486] sbitmap_queue_init_node+0x27f/0x5d0 [ 3406.151243] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 3406.156518] blk_mq_init_tags+0x14b/0x280 [ 3406.160666] blk_mq_alloc_rq_map+0x90/0x220 [ 3406.164989] blk_mq_sched_alloc_tags+0xaa/0x240 [ 3406.169658] blk_mq_init_sched+0x18d/0x4a0 [ 3406.173889] ? _raw_spin_unlock+0x29/0x40 [ 3406.178034] elevator_init+0x2ee/0x410 [ 3406.181916] blk_mq_sched_init+0x28/0x40 [ 3406.185976] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3406.191084] blk_mq_init_queue+0x5a/0x90 [ 3406.195146] loop_add+0x303/0x830 [ 3406.198602] ? loop_queue_rq+0x280/0x280 [ 3406.202657] ? loop_queue_work+0x21e0/0x21e0 [ 3406.207069] loop_control_ioctl+0x11a/0x3f0 [ 3406.211385] ? loop_lookup+0x190/0x190 [ 3406.215277] ? SyS_write+0x1b7/0x210 [ 3406.218990] ? loop_lookup+0x190/0x190 [ 3406.222877] do_vfs_ioctl+0x75a/0xff0 [ 3406.226681] ? lock_acquire+0x170/0x3f0 [ 3406.230657] ? ioctl_preallocate+0x1a0/0x1a0 [ 3406.235063] ? __fget+0x265/0x3e0 [ 3406.238604] ? do_vfs_ioctl+0xff0/0xff0 [ 3406.242580] ? security_file_ioctl+0x83/0xb0 [ 3406.246987] SyS_ioctl+0x7f/0xb0 [ 3406.250350] ? do_vfs_ioctl+0xff0/0xff0 [ 3406.254323] do_syscall_64+0x1d5/0x640 [ 3406.258213] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3406.263405] RIP: 0033:0x7f0bff8e60c9 [ 3406.267111] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3406.274814] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3406.282078] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = getuid() r1 = getuid() setresuid(r0, r0, r1) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) setresuid(r0, r2, r0) setresuid(0x0, 0xee01, 0x0) (async) getuid() (async) getuid() (async) setresuid(r0, r0, r1) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) setresuid(r0, r2, r0) (async) 09:01:19 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 43) 09:01:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x1, 0x80002) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000180)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000080)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYRES8=r0]) 09:01:19 executing program 0: socket(0x28, 0x0, 0x2) r0 = syz_open_dev$rtc(&(0x7f0000000040), 0x9, 0x300) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) [ 3406.289341] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3406.296604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3406.303868] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:19 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 09:01:19 executing program 5: syz_open_dev$media(&(0x7f0000000000), 0x81, 0x200) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) getpeername$unix(r2, &(0x7f0000000080)=@abs, &(0x7f0000000180)=0x6e) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f00000005c0)={'erspan0\x00', &(0x7f00000004c0)={'syztnl1\x00', 0x0, 0x8, 0x8000, 0x7f, 0x101, {{0x2d, 0x4, 0x0, 0x8, 0xb4, 0x66, 0x0, 0x81, 0x2f, 0x0, @remote, @multicast2, {[@ssrr={0x89, 0x27, 0xa8, [@local, @dev={0xac, 0x14, 0x14, 0x18}, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @broadcast, @empty, @multicast1, @private=0xa010100]}, @timestamp_prespec={0x44, 0x2c, 0x88, 0x3, 0x5, [{@local, 0x400}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xfc21}, {@empty, 0x8}, {@multicast1, 0x5}, {@local, 0x80000001}]}, @end, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x18, 0x75, 0x0, 0x2, [0x190f, 0xffffffff, 0x7, 0x3, 0xec09]}, @cipso={0x86, 0x2e, 0x2, [{0x1, 0xa, "ae29cc7d1a0e1175"}, {0x1, 0xc, "96204ac0495f04aaa41a"}, {0x6, 0x12, "e7f8e4791de0e70eaca0fe1f391d6998"}]}, @noop]}}}}}) sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x30}}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_IFINDEX={0x8, 0xb, r4}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x1) r5 = syz_open_dev$rtc(&(0x7f00000001c0), 0x5, 0x340) ioctl$RTC_UIE_OFF(r5, 0x7004) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="faffffffa9db93b6c0178f0299dc70d01369ff456cf047355ae6ad672319918c189e6f50af74744c2bb5114c8cb80b792641dd03e0abcce80d3f6cc5b3b1f620fe5252a04d7320a268adb4ddfbc451b07f11000000000800000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008175eb4724600cc93214fb6ceb747555ebcbf3074ce447747b5552c523da04fd30c2ae9ad101efee4806218de27575c4efd68c73c42561931f4fde4c8f55bc5bf5a917c561504a2b7a96370dbe11ad2bbdec9d73d7dd2614454b0e6b6d26b79501e56115144552b3fe5ad502e563aca51d315483b41f90358a998ea306ef921b48262953f5476e8554dacd86e382519acce81b4a653ff6ec671c5f45b632a8ead806f2fb62a2ab2cddfeea1550e4dc7895e2d9d7c1ad7f3319d61626f2619604833fb2f43706e792952af88fc6d63ad51335186989996a83050ce3e7bf94e324a0c3ae8d90cee394cb1303f72e8e89a0984d0bc9d884ed3dd7fe026d056a30154b966775b66787201f6be0974939c2175f3a6c96b97fcc47fde898b29ef7fbc31ea0c7ba0e588984b749ba3c1735e76377c979a5b3b1b6a15b90f4689d0a6edd72dd0"], 0x1c}}, 0x0) 09:01:19 executing program 2: setresuid(0x0, 0xee01, 0x0) r0 = socket$unix(0x1, 0x4, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)=[{{&(0x7f0000001a00)=@abs, 0x6e, &(0x7f0000001c00)=[{&(0x7f0000001a80)=""/3, 0x3}, {&(0x7f0000001ac0)=""/41, 0x29}, {&(0x7f0000001b00)=""/13, 0xd}, {&(0x7f0000001b40)=""/185, 0xb9}], 0x4, &(0x7f0000001c40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}], 0x1, 0x0, &(0x7f0000001d80)) recvmmsg$unix(r0, &(0x7f0000001940)=[{{&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000100)=""/215, 0xd7}, {&(0x7f0000000200)=""/92, 0x5c}, {&(0x7f0000000000)=""/14, 0xe}, {&(0x7f0000000280)=""/186, 0xba}, {&(0x7f0000000340)=""/8, 0x8}, {&(0x7f0000000380)=""/133, 0x85}], 0x6}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/51, 0x33}, {&(0x7f0000000580)=""/123, 0x7b}, {&(0x7f0000000600)=""/123, 0x7b}, {&(0x7f0000000680)=""/244, 0xf4}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/47, 0x2f}, {&(0x7f00000017c0)=""/196, 0xc4}], 0x7}}], 0x2, 0x400100e1, &(0x7f00000019c0)={0x0, 0x989680}) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:19 executing program 5: syz_open_dev$media(&(0x7f0000000000), 0x81, 0x200) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) getpeername$unix(r2, &(0x7f0000000080)=@abs, &(0x7f0000000180)=0x6e) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f00000005c0)={'erspan0\x00', &(0x7f00000004c0)={'syztnl1\x00', 0x0, 0x8, 0x8000, 0x7f, 0x101, {{0x2d, 0x4, 0x0, 0x8, 0xb4, 0x66, 0x0, 0x81, 0x2f, 0x0, @remote, @multicast2, {[@ssrr={0x89, 0x27, 0xa8, [@local, @dev={0xac, 0x14, 0x14, 0x18}, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @broadcast, @empty, @multicast1, @private=0xa010100]}, @timestamp_prespec={0x44, 0x2c, 0x88, 0x3, 0x5, [{@local, 0x400}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xfc21}, {@empty, 0x8}, {@multicast1, 0x5}, {@local, 0x80000001}]}, @end, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x18, 0x75, 0x0, 0x2, [0x190f, 0xffffffff, 0x7, 0x3, 0xec09]}, @cipso={0x86, 0x2e, 0x2, [{0x1, 0xa, "ae29cc7d1a0e1175"}, {0x1, 0xc, "96204ac0495f04aaa41a"}, {0x6, 0x12, "e7f8e4791de0e70eaca0fe1f391d6998"}]}, @noop]}}}}}) sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x30}}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_IFINDEX={0x8, 0xb, r4}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x1) (async) r5 = syz_open_dev$rtc(&(0x7f00000001c0), 0x5, 0x340) ioctl$RTC_UIE_OFF(r5, 0x7004) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="faffffffa9db93b6c0178f0299dc70d01369ff456cf047355ae6ad672319918c189e6f50af74744c2bb5114c8cb80b792641dd03e0abcce80d3f6cc5b3b1f620fe5252a04d7320a268adb4ddfbc451b07f11000000000800000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008175eb4724600cc93214fb6ceb747555ebcbf3074ce447747b5552c523da04fd30c2ae9ad101efee4806218de27575c4efd68c73c42561931f4fde4c8f55bc5bf5a917c561504a2b7a96370dbe11ad2bbdec9d73d7dd2614454b0e6b6d26b79501e56115144552b3fe5ad502e563aca51d315483b41f90358a998ea306ef921b48262953f5476e8554dacd86e382519acce81b4a653ff6ec671c5f45b632a8ead806f2fb62a2ab2cddfeea1550e4dc7895e2d9d7c1ad7f3319d61626f2619604833fb2f43706e792952af88fc6d63ad51335186989996a83050ce3e7bf94e324a0c3ae8d90cee394cb1303f72e8e89a0984d0bc9d884ed3dd7fe026d056a30154b966775b66787201f6be0974939c2175f3a6c96b97fcc47fde898b29ef7fbc31ea0c7ba0e588984b749ba3c1735e76377c979a5b3b1b6a15b90f4689d0a6edd72dd0"], 0x1c}}, 0x0) [ 3406.416342] FAULT_INJECTION: forcing a failure. [ 3406.416342] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3406.445263] CPU: 0 PID: 23241 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3406.453162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3406.462526] Call Trace: [ 3406.465113] dump_stack+0x1b2/0x281 [ 3406.468745] should_fail.cold+0x10a/0x149 [ 3406.472888] __alloc_pages_nodemask+0x21e/0x2900 [ 3406.477625] ? __kmalloc_node+0x4c/0x70 [ 3406.481573] ? blk_mq_alloc_rq_map+0x113/0x220 [ 3406.486131] ? blk_mq_init_sched+0x18d/0x4a0 [ 3406.490524] ? elevator_init+0x2ee/0x410 [ 3406.494564] ? loop_control_ioctl+0x11a/0x3f0 [ 3406.499035] ? do_vfs_ioctl+0x75a/0xff0 [ 3406.502986] ? do_syscall_64+0x1d5/0x640 [ 3406.507032] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3406.512382] ? __mutex_unlock_slowpath+0x75/0x770 [ 3406.517208] ? fs_reclaim_release+0xd0/0x110 [ 3406.521596] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 3406.526459] ? __lockdep_init_map+0x100/0x560 [ 3406.530940] ? _find_next_bit+0xdb/0x100 [ 3406.534983] ? __cpu_to_node+0x7b/0xa0 [ 3406.539372] ? memset+0x20/0x40 [ 3406.542629] blk_mq_alloc_rqs+0x227/0x6d0 [ 3406.546766] blk_mq_sched_alloc_tags+0x112/0x240 [ 3406.551507] blk_mq_init_sched+0x18d/0x4a0 [ 3406.555724] ? _raw_spin_unlock+0x29/0x40 [ 3406.559855] elevator_init+0x2ee/0x410 [ 3406.563725] blk_mq_sched_init+0x28/0x40 [ 3406.567772] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3406.572865] blk_mq_init_queue+0x5a/0x90 [ 3406.576990] loop_add+0x303/0x830 [ 3406.580522] ? loop_queue_rq+0x280/0x280 [ 3406.584562] ? loop_queue_work+0x21e0/0x21e0 [ 3406.588966] loop_control_ioctl+0x11a/0x3f0 [ 3406.593317] ? loop_lookup+0x190/0x190 [ 3406.597183] ? SyS_write+0x1b7/0x210 [ 3406.600875] ? loop_lookup+0x190/0x190 [ 3406.604739] do_vfs_ioctl+0x75a/0xff0 [ 3406.608528] ? lock_acquire+0x170/0x3f0 [ 3406.612484] ? ioctl_preallocate+0x1a0/0x1a0 [ 3406.616871] ? __fget+0x265/0x3e0 [ 3406.620300] ? do_vfs_ioctl+0xff0/0xff0 [ 3406.624252] ? security_file_ioctl+0x83/0xb0 [ 3406.628645] SyS_ioctl+0x7f/0xb0 [ 3406.632002] ? do_vfs_ioctl+0xff0/0xff0 [ 3406.635961] do_syscall_64+0x1d5/0x640 [ 3406.639831] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3406.645088] RIP: 0033:0x7f0bff8e60c9 [ 3406.648790] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3406.656485] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) r0 = socket$unix(0x1, 0x4, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)=[{{&(0x7f0000001a00)=@abs, 0x6e, &(0x7f0000001c00)=[{&(0x7f0000001a80)=""/3, 0x3}, {&(0x7f0000001ac0)=""/41, 0x29}, {&(0x7f0000001b00)=""/13, 0xd}, {&(0x7f0000001b40)=""/185, 0xb9}], 0x4, &(0x7f0000001c40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}], 0x1, 0x0, &(0x7f0000001d80)) (async) recvmmsg$unix(r0, &(0x7f0000001940)=[{{&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000100)=""/215, 0xd7}, {&(0x7f0000000200)=""/92, 0x5c}, {&(0x7f0000000000)=""/14, 0xe}, {&(0x7f0000000280)=""/186, 0xba}, {&(0x7f0000000340)=""/8, 0x8}, {&(0x7f0000000380)=""/133, 0x85}], 0x6}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/51, 0x33}, {&(0x7f0000000580)=""/123, 0x7b}, {&(0x7f0000000600)=""/123, 0x7b}, {&(0x7f0000000680)=""/244, 0xf4}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/47, 0x2f}, {&(0x7f00000017c0)=""/196, 0xc4}], 0x7}}], 0x2, 0x400100e1, &(0x7f00000019c0)={0x0, 0x989680}) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:20 executing program 0: socket(0x28, 0x0, 0x2) (async) r0 = syz_open_dev$rtc(&(0x7f0000000040), 0x9, 0x300) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) 09:01:20 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 44) [ 3406.663730] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3406.670977] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3406.678227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3406.685471] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:20 executing program 1: ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) 09:01:20 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:20 executing program 0: socket(0x28, 0x0, 0x2) r0 = syz_open_dev$rtc(&(0x7f0000000040), 0x9, 0x300) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) socket(0x28, 0x0, 0x2) (async) syz_open_dev$rtc(&(0x7f0000000040), 0x9, 0x300) (async) ioctl$RTC_VL_CLR(r0, 0x7014) (async) syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x0) (async) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000140)) (async) 09:01:20 executing program 5: syz_open_dev$media(&(0x7f0000000000), 0x81, 0x200) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r2) (async) getpeername$unix(r2, &(0x7f0000000080)=@abs, &(0x7f0000000180)=0x6e) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f00000005c0)={'erspan0\x00', &(0x7f00000004c0)={'syztnl1\x00', 0x0, 0x8, 0x8000, 0x7f, 0x101, {{0x2d, 0x4, 0x0, 0x8, 0xb4, 0x66, 0x0, 0x81, 0x2f, 0x0, @remote, @multicast2, {[@ssrr={0x89, 0x27, 0xa8, [@local, @dev={0xac, 0x14, 0x14, 0x18}, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @broadcast, @empty, @multicast1, @private=0xa010100]}, @timestamp_prespec={0x44, 0x2c, 0x88, 0x3, 0x5, [{@local, 0x400}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xfc21}, {@empty, 0x8}, {@multicast1, 0x5}, {@local, 0x80000001}]}, @end, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x18, 0x75, 0x0, 0x2, [0x190f, 0xffffffff, 0x7, 0x3, 0xec09]}, @cipso={0x86, 0x2e, 0x2, [{0x1, 0xa, "ae29cc7d1a0e1175"}, {0x1, 0xc, "96204ac0495f04aaa41a"}, {0x6, 0x12, "e7f8e4791de0e70eaca0fe1f391d6998"}]}, @noop]}}}}}) sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x38, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x30}}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_IFINDEX={0x8, 0xb, r4}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x1) (async) r5 = syz_open_dev$rtc(&(0x7f00000001c0), 0x5, 0x340) ioctl$RTC_UIE_OFF(r5, 0x7004) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="faffffffa9db93b6c0178f0299dc70d01369ff456cf047355ae6ad672319918c189e6f50af74744c2bb5114c8cb80b792641dd03e0abcce80d3f6cc5b3b1f620fe5252a04d7320a268adb4ddfbc451b07f11000000000800000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008175eb4724600cc93214fb6ceb747555ebcbf3074ce447747b5552c523da04fd30c2ae9ad101efee4806218de27575c4efd68c73c42561931f4fde4c8f55bc5bf5a917c561504a2b7a96370dbe11ad2bbdec9d73d7dd2614454b0e6b6d26b79501e56115144552b3fe5ad502e563aca51d315483b41f90358a998ea306ef921b48262953f5476e8554dacd86e382519acce81b4a653ff6ec671c5f45b632a8ead806f2fb62a2ab2cddfeea1550e4dc7895e2d9d7c1ad7f3319d61626f2619604833fb2f43706e792952af88fc6d63ad51335186989996a83050ce3e7bf94e324a0c3ae8d90cee394cb1303f72e8e89a0984d0bc9d884ed3dd7fe026d056a30154b966775b66787201f6be0974939c2175f3a6c96b97fcc47fde898b29ef7fbc31ea0c7ba0e588984b749ba3c1735e76377c979a5b3b1b6a15b90f4689d0a6edd72dd0"], 0x1c}}, 0x0) 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) (async, rerun: 64) r0 = socket$unix(0x1, 0x4, 0x0) (rerun: 64) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)=[{{&(0x7f0000001a00)=@abs, 0x6e, &(0x7f0000001c00)=[{&(0x7f0000001a80)=""/3, 0x3}, {&(0x7f0000001ac0)=""/41, 0x29}, {&(0x7f0000001b00)=""/13, 0xd}, {&(0x7f0000001b40)=""/185, 0xb9}], 0x4, &(0x7f0000001c40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}], 0x1, 0x0, &(0x7f0000001d80)) (async) recvmmsg$unix(r0, &(0x7f0000001940)=[{{&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000100)=""/215, 0xd7}, {&(0x7f0000000200)=""/92, 0x5c}, {&(0x7f0000000000)=""/14, 0xe}, {&(0x7f0000000280)=""/186, 0xba}, {&(0x7f0000000340)=""/8, 0x8}, {&(0x7f0000000380)=""/133, 0x85}], 0x6}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/51, 0x33}, {&(0x7f0000000580)=""/123, 0x7b}, {&(0x7f0000000600)=""/123, 0x7b}, {&(0x7f0000000680)=""/244, 0xf4}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/47, 0x2f}, {&(0x7f00000017c0)=""/196, 0xc4}], 0x7}}], 0x2, 0x400100e1, &(0x7f00000019c0)={0x0, 0x989680}) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:20 executing program 1: ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f0000000080)) (async) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) [ 3406.861040] FAULT_INJECTION: forcing a failure. [ 3406.861040] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3406.876096] CPU: 1 PID: 23279 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3406.884000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3406.893380] Call Trace: [ 3406.895973] dump_stack+0x1b2/0x281 [ 3406.899606] should_fail.cold+0x10a/0x149 [ 3406.903756] __alloc_pages_nodemask+0x21e/0x2900 09:01:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES8=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3406.908505] ? __kmalloc_node+0x4c/0x70 [ 3406.912478] ? blk_mq_alloc_rq_map+0x113/0x220 [ 3406.917059] ? blk_mq_init_sched+0x18d/0x4a0 [ 3406.921457] ? elevator_init+0x2ee/0x410 [ 3406.925512] ? blk_mq_sched_init+0x28/0x40 [ 3406.929740] ? loop_add+0x303/0x830 [ 3406.933351] ? loop_control_ioctl+0x11a/0x3f0 [ 3406.937821] ? do_vfs_ioctl+0x75a/0xff0 [ 3406.941772] ? do_syscall_64+0x1d5/0x640 [ 3406.945810] ? entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3406.951152] ? lock_acquire+0x170/0x3f0 [ 3406.955105] ? lock_downgrade+0x740/0x740 [ 3406.959228] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 3406.964075] ? __lockdep_init_map+0x100/0x560 [ 3406.968545] ? _find_next_bit+0xdb/0x100 [ 3406.972582] ? __cpu_to_node+0x7b/0xa0 [ 3406.976445] ? blk_mq_hw_queue_to_node+0x9f/0xf0 [ 3406.981176] blk_mq_alloc_rqs+0x227/0x6d0 [ 3406.985315] ? blk_mq_alloc_rq_map+0x9d/0x220 [ 3406.989880] blk_mq_sched_alloc_tags+0x112/0x240 [ 3406.994614] blk_mq_init_sched+0x18d/0x4a0 [ 3406.998824] ? _raw_spin_unlock+0x29/0x40 [ 3407.002950] elevator_init+0x2ee/0x410 [ 3407.006822] blk_mq_sched_init+0x28/0x40 [ 3407.010868] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3407.015952] blk_mq_init_queue+0x5a/0x90 [ 3407.019992] loop_add+0x303/0x830 [ 3407.023421] ? loop_queue_rq+0x280/0x280 [ 3407.027457] ? loop_queue_work+0x21e0/0x21e0 [ 3407.031842] loop_control_ioctl+0x11a/0x3f0 [ 3407.036141] ? loop_lookup+0x190/0x190 [ 3407.040005] ? SyS_write+0x1b7/0x210 [ 3407.043694] ? loop_lookup+0x190/0x190 [ 3407.047559] do_vfs_ioctl+0x75a/0xff0 [ 3407.051338] ? lock_acquire+0x170/0x3f0 [ 3407.055287] ? ioctl_preallocate+0x1a0/0x1a0 [ 3407.059670] ? __fget+0x265/0x3e0 [ 3407.063184] ? do_vfs_ioctl+0xff0/0xff0 [ 3407.067136] ? security_file_ioctl+0x83/0xb0 [ 3407.071518] SyS_ioctl+0x7f/0xb0 [ 3407.074858] ? do_vfs_ioctl+0xff0/0xff0 [ 3407.078809] do_syscall_64+0x1d5/0x640 [ 3407.082675] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3407.087842] RIP: 0033:0x7f0bff8e60c9 [ 3407.091527] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3407.099211] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$SNDCTL_SEQ_NRMIDIS(0xffffffffffffffff, 0x8004510b, &(0x7f0000000000)) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000080)=0x5) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) recvmsg$unix(r0, &(0x7f0000000580)={&(0x7f00000000c0)=@abs, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000140)}, {&(0x7f00000005c0)=""/116, 0x74}, {&(0x7f0000000200)=""/71, 0x47}, {&(0x7f0000000280)=""/150, 0x96}, {&(0x7f0000000640)=""/196, 0xc4}, {&(0x7f0000000400)=""/96, 0x60}, {&(0x7f0000000480)=""/113, 0x71}], 0x7}, 0x2) 09:01:20 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 45) [ 3407.106454] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3407.113702] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3407.120947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3407.128193] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$SNDCTL_SEQ_NRMIDIS(0xffffffffffffffff, 0x8004510b, &(0x7f0000000000)) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000080)=0x5) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) recvmsg$unix(r0, &(0x7f0000000580)={&(0x7f00000000c0)=@abs, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000140)}, {&(0x7f00000005c0)=""/116, 0x74}, {&(0x7f0000000200)=""/71, 0x47}, {&(0x7f0000000280)=""/150, 0x96}, {&(0x7f0000000640)=""/196, 0xc4}, {&(0x7f0000000400)=""/96, 0x60}, {&(0x7f0000000480)=""/113, 0x71}], 0x7}, 0x2) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$SNDCTL_SEQ_NRMIDIS(0xffffffffffffffff, 0x8004510b, &(0x7f0000000000)) (async) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000080)=0x5) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) recvmsg$unix(r0, &(0x7f0000000580)={&(0x7f00000000c0)=@abs, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000140)}, {&(0x7f00000005c0)=""/116, 0x74}, {&(0x7f0000000200)=""/71, 0x47}, {&(0x7f0000000280)=""/150, 0x96}, {&(0x7f0000000640)=""/196, 0xc4}, {&(0x7f0000000400)=""/96, 0x60}, {&(0x7f0000000480)=""/113, 0x71}], 0x7}, 0x2) (async) 09:01:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES8=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) 09:01:20 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) (async) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) (async) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) (async) socket(0x0, 0x80000, 0x9) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) 09:01:20 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r1) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x28, r3, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0xb1a3d4226065eeed}, 0x90) 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$SNDCTL_SEQ_NRMIDIS(0xffffffffffffffff, 0x8004510b, &(0x7f0000000000)) (async) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000080)=0x5) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async, rerun: 32) recvmsg$unix(r0, &(0x7f0000000580)={&(0x7f00000000c0)=@abs, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000140)}, {&(0x7f00000005c0)=""/116, 0x74}, {&(0x7f0000000200)=""/71, 0x47}, {&(0x7f0000000280)=""/150, 0x96}, {&(0x7f0000000640)=""/196, 0xc4}, {&(0x7f0000000400)=""/96, 0x60}, {&(0x7f0000000480)=""/113, 0x71}], 0x7}, 0x2) (rerun: 32) 09:01:20 executing program 1: ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f0000000080)) (async) syz_open_dev$loop(&(0x7f0000000000), 0x3b, 0x0) 09:01:20 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) (async) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r1) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x28, r3, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0xb1a3d4226065eeed}, 0x90) 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) r1 = getuid() r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(r0, r1, 0xee01) r3 = getuid() r4 = getuid() setresuid(r3, r4, 0xee00) r5 = getuid() r6 = getuid() setresuid(r5, r6, 0xee00) r7 = getuid() r8 = getuid() setresuid(r7, r8, 0xee00) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) r10 = getuid() recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002180)=[{{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000300)=""/135, 0x87}, {&(0x7f00000003c0)=""/53, 0x35}, {&(0x7f0000000400)=""/43, 0x2b}, {&(0x7f0000000440)=""/228, 0xe4}, {&(0x7f0000000540)=""/150, 0x96}], 0x5}}, {{&(0x7f0000000680), 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000700)=""/131, 0x83}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000800)=""/246, 0xf6}, {&(0x7f0000000900)=""/40, 0x28}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/150, 0x96}, {&(0x7f0000001a00)=""/173, 0xad}], 0x5, &(0x7f0000001b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000001254000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}, {{&(0x7f0000001c80)=@abs, 0x6e, &(0x7f0000001ec0)=[{&(0x7f0000001d00)=""/65, 0x41}, {&(0x7f0000001d80)=""/135, 0x87}, {&(0x7f0000001e40)=""/84, 0x54}], 0x3, &(0x7f0000001f00)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000001f80), 0x6e, &(0x7f0000002140)=[{&(0x7f0000002000)=""/133, 0x85}, {&(0x7f00000020c0)=""/43, 0x2b}, {&(0x7f0000002100)=""/17, 0x11}], 0x3}}], 0x5, 0x20, &(0x7f00000022c0)={0x77359400}) r11 = getuid() setresuid(r10, r11, 0xee00) setresuid(r11, r9, 0xee01) r12 = getuid() r13 = getuid() setresuid(r12, r13, 0xee00) r14 = getuid() r15 = getuid() setresuid(r14, r15, 0xee00) getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) setresuid(r12, r14, r16) [ 3407.322759] FAULT_INJECTION: forcing a failure. [ 3407.322759] name failslab, interval 1, probability 0, space 0, times 0 [ 3407.345180] CPU: 0 PID: 23336 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3407.353075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3407.362421] Call Trace: [ 3407.365179] dump_stack+0x1b2/0x281 [ 3407.368804] should_fail.cold+0x10a/0x149 09:01:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES8=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES8=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (async) [ 3407.372954] should_failslab+0xd6/0x130 [ 3407.376926] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3407.382027] dd_init_queue+0x94/0x420 [ 3407.385854] blk_mq_init_sched+0x214/0x4a0 [ 3407.390071] ? _raw_spin_unlock+0x29/0x40 [ 3407.394198] elevator_init+0x2ee/0x410 [ 3407.398070] blk_mq_sched_init+0x28/0x40 [ 3407.402118] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 3407.407209] blk_mq_init_queue+0x5a/0x90 [ 3407.411247] loop_add+0x303/0x830 [ 3407.414676] ? loop_queue_rq+0x280/0x280 [ 3407.418718] ? loop_queue_work+0x21e0/0x21e0 [ 3407.423114] loop_control_ioctl+0x11a/0x3f0 [ 3407.427415] ? loop_lookup+0x190/0x190 [ 3407.431276] ? SyS_write+0x1b7/0x210 [ 3407.434965] ? loop_lookup+0x190/0x190 [ 3407.438830] do_vfs_ioctl+0x75a/0xff0 [ 3407.442610] ? lock_acquire+0x170/0x3f0 [ 3407.446561] ? ioctl_preallocate+0x1a0/0x1a0 [ 3407.450954] ? __fget+0x265/0x3e0 [ 3407.454481] ? do_vfs_ioctl+0xff0/0xff0 [ 3407.458434] ? security_file_ioctl+0x83/0xb0 [ 3407.462820] SyS_ioctl+0x7f/0xb0 [ 3407.466161] ? do_vfs_ioctl+0xff0/0xff0 [ 3407.470115] do_syscall_64+0x1d5/0x640 [ 3407.473981] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3407.479147] RIP: 0033:0x7f0bff8e60c9 [ 3407.482831] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3407.490514] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3407.497758] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3407.505012] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3407.512255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) (async) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) r1 = getuid() (async) r2 = getuid() setresuid(r1, r2, 0xee00) (async) setresuid(r0, r1, 0xee01) (async) r3 = getuid() (async) r4 = getuid() setresuid(r3, r4, 0xee00) (async) r5 = getuid() (async) r6 = getuid() setresuid(r5, r6, 0xee00) (async) r7 = getuid() (async) r8 = getuid() setresuid(r7, r8, 0xee00) (async) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) (async) r10 = getuid() (async) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002180)=[{{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000300)=""/135, 0x87}, {&(0x7f00000003c0)=""/53, 0x35}, {&(0x7f0000000400)=""/43, 0x2b}, {&(0x7f0000000440)=""/228, 0xe4}, {&(0x7f0000000540)=""/150, 0x96}], 0x5}}, {{&(0x7f0000000680), 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000700)=""/131, 0x83}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000800)=""/246, 0xf6}, {&(0x7f0000000900)=""/40, 0x28}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/150, 0x96}, {&(0x7f0000001a00)=""/173, 0xad}], 0x5, &(0x7f0000001b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000001254000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}, {{&(0x7f0000001c80)=@abs, 0x6e, &(0x7f0000001ec0)=[{&(0x7f0000001d00)=""/65, 0x41}, {&(0x7f0000001d80)=""/135, 0x87}, {&(0x7f0000001e40)=""/84, 0x54}], 0x3, &(0x7f0000001f00)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000001f80), 0x6e, &(0x7f0000002140)=[{&(0x7f0000002000)=""/133, 0x85}, {&(0x7f00000020c0)=""/43, 0x2b}, {&(0x7f0000002100)=""/17, 0x11}], 0x3}}], 0x5, 0x20, &(0x7f00000022c0)={0x77359400}) (async) r11 = getuid() setresuid(r10, r11, 0xee00) setresuid(r11, r9, 0xee01) r12 = getuid() r13 = getuid() setresuid(r12, r13, 0xee00) r14 = getuid() (async) r15 = getuid() setresuid(r14, r15, 0xee00) (async) getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) setresuid(r12, r14, r16) 09:01:20 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x5, 0xa, 0x4009) recvmmsg$unix(r0, &(0x7f0000000b40)=[{{&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000280)=""/84, 0x54}], 0x1, &(0x7f0000000340)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}, {{&(0x7f0000000440)=@abs, 0x6e, &(0x7f0000000780)=[{&(0x7f00000004c0)=""/87, 0x57}, {&(0x7f0000000540)=""/151, 0x97}, {&(0x7f0000000600)=""/183, 0xb7}, {&(0x7f00000006c0)=""/180, 0xb4}], 0x4, &(0x7f00000007c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000800)=@abs, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000880)=""/122, 0x7a}, {&(0x7f0000000900)=""/119, 0x77}], 0x2, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x148}}], 0x3, 0x101, &(0x7f0000000c00)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'xfrm0\x00'}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000080)) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x7, 0x8, 0x3, 0x5, 0x1, 0x7fffffffffffffff, 0x1, 0x2, 0xa2a, 0x7, 0x8001, 0x6, 0x1, 0xd6, 0xffff, 0x3]}) 09:01:20 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 46) 09:01:20 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x800003b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0x4, {0x5f, 0x3ff, 0x800, 0xfffffff8, 0x2, 0x4}}) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f00000000c0)) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20080, 0x0) 09:01:20 executing program 5: ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, &(0x7f00000000c0)={0x0, 0x1, 0x0, [{0x0, 0xffffffffffffffff, 0x8000, 0x9, 0x2, 0x0, 0x8, '\x00', 0x9}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000200)={0x401, 0xff}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x60500, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$rtc(&(0x7f0000000140), 0x3ff, 0x10000) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f00000001c0)) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3407.519506] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:20 executing program 2: setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2\x00', 0x1ff) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) (async) r1 = getuid() (async) r2 = getuid() setresuid(r1, r2, 0xee00) setresuid(r0, r1, 0xee01) (async) r3 = getuid() (async) r4 = getuid() setresuid(r3, r4, 0xee00) (async) r5 = getuid() (async) r6 = getuid() setresuid(r5, r6, 0xee00) (async) r7 = getuid() (async) r8 = getuid() setresuid(r7, r8, 0xee00) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) r10 = getuid() (async) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002180)=[{{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000300)=""/135, 0x87}, {&(0x7f00000003c0)=""/53, 0x35}, {&(0x7f0000000400)=""/43, 0x2b}, {&(0x7f0000000440)=""/228, 0xe4}, {&(0x7f0000000540)=""/150, 0x96}], 0x5}}, {{&(0x7f0000000680), 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000700)=""/131, 0x83}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000800)=""/246, 0xf6}, {&(0x7f0000000900)=""/40, 0x28}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/150, 0x96}, {&(0x7f0000001a00)=""/173, 0xad}], 0x5, &(0x7f0000001b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000001254000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}, {{&(0x7f0000001c80)=@abs, 0x6e, &(0x7f0000001ec0)=[{&(0x7f0000001d00)=""/65, 0x41}, {&(0x7f0000001d80)=""/135, 0x87}, {&(0x7f0000001e40)=""/84, 0x54}], 0x3, &(0x7f0000001f00)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000001f80), 0x6e, &(0x7f0000002140)=[{&(0x7f0000002000)=""/133, 0x85}, {&(0x7f00000020c0)=""/43, 0x2b}, {&(0x7f0000002100)=""/17, 0x11}], 0x3}}], 0x5, 0x20, &(0x7f00000022c0)={0x77359400}) (async) r11 = getuid() setresuid(r10, r11, 0xee00) setresuid(r11, r9, 0xee01) (async) r12 = getuid() (async) r13 = getuid() setresuid(r12, r13, 0xee00) r14 = getuid() (async) r15 = getuid() setresuid(r14, r15, 0xee00) getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) setresuid(r12, r14, r16) 09:01:20 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r1) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x28, r3, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0xb1a3d4226065eeed}, 0x90) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) (async) syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r1) (async) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x28, r3, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0xb1a3d4226065eeed}, 0x90) (async) 09:01:21 executing program 5: ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) (async) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, &(0x7f00000000c0)={0x0, 0x1, 0x0, [{0x0, 0xffffffffffffffff, 0x8000, 0x9, 0x2, 0x0, 0x8, '\x00', 0x9}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000200)={0x401, 0xff}) (async, rerun: 32) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x60500, 0x0) (rerun: 32) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$rtc(&(0x7f0000000140), 0x3ff, 0x10000) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f00000001c0)) (async, rerun: 32) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (rerun: 32) 09:01:21 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x800003b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0x4, {0x5f, 0x3ff, 0x800, 0xfffffff8, 0x2, 0x4}}) (async) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f00000000c0)) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20080, 0x0) 09:01:21 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x140) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0xfff) setresuid(0xee00, 0xee01, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000100)=""/103, 0x67}, {&(0x7f0000000180)=""/94, 0x5e}], 0x2}, 0x40000100) 09:01:21 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) [ 3407.754002] FAULT_INJECTION: forcing a failure. [ 3407.754002] name failslab, interval 1, probability 0, space 0, times 0 [ 3407.772381] CPU: 0 PID: 23392 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3407.780300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3407.789648] Call Trace: [ 3407.792236] dump_stack+0x1b2/0x281 [ 3407.795861] should_fail.cold+0x10a/0x149 [ 3407.800009] should_failslab+0xd6/0x130 [ 3407.803985] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3407.809092] alloc_disk_node+0x5d/0x3d0 [ 3407.813076] loop_add+0x3cb/0x830 [ 3407.816532] ? loop_queue_rq+0x280/0x280 [ 3407.820590] ? loop_queue_work+0x21e0/0x21e0 [ 3407.824991] loop_control_ioctl+0x11a/0x3f0 [ 3407.829311] ? loop_lookup+0x190/0x190 [ 3407.833192] ? SyS_write+0x1b7/0x210 [ 3407.836902] ? loop_lookup+0x190/0x190 [ 3407.840788] do_vfs_ioctl+0x75a/0xff0 [ 3407.844589] ? lock_acquire+0x170/0x3f0 [ 3407.848561] ? ioctl_preallocate+0x1a0/0x1a0 [ 3407.852958] ? __fget+0x265/0x3e0 [ 3407.856398] ? do_vfs_ioctl+0xff0/0xff0 [ 3407.860360] ? security_file_ioctl+0x83/0xb0 [ 3407.864743] SyS_ioctl+0x7f/0xb0 [ 3407.868093] ? do_vfs_ioctl+0xff0/0xff0 [ 3407.872057] do_syscall_64+0x1d5/0x640 [ 3407.875944] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3407.881121] RIP: 0033:0x7f0bff8e60c9 [ 3407.884814] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3407.892519] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 09:01:21 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) (async) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x140) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0xfff) setresuid(0xee00, 0xee01, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000100)=""/103, 0x67}, {&(0x7f0000000180)=""/94, 0x5e}], 0x2}, 0x40000100) 09:01:21 executing program 5: ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000000)) (async) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, &(0x7f00000000c0)={0x0, 0x1, 0x0, [{0x0, 0xffffffffffffffff, 0x8000, 0x9, 0x2, 0x0, 0x8, '\x00', 0x9}]}) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000200)={0x401, 0xff}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x60500, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_open_dev$rtc(&(0x7f0000000140), 0x3ff, 0x10000) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f00000001c0)) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) [ 3407.899776] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3407.907034] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3407.914291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3407.921538] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:21 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x5, 0xa, 0x4009) (async) recvmmsg$unix(r0, &(0x7f0000000b40)=[{{&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000280)=""/84, 0x54}], 0x1, &(0x7f0000000340)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}, {{&(0x7f0000000440)=@abs, 0x6e, &(0x7f0000000780)=[{&(0x7f00000004c0)=""/87, 0x57}, {&(0x7f0000000540)=""/151, 0x97}, {&(0x7f0000000600)=""/183, 0xb7}, {&(0x7f00000006c0)=""/180, 0xb4}], 0x4, &(0x7f00000007c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000800)=@abs, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000880)=""/122, 0x7a}, {&(0x7f0000000900)=""/119, 0x77}], 0x2, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x148}}], 0x3, 0x101, &(0x7f0000000c00)) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'xfrm0\x00'}) (async) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000080)) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x7, 0x8, 0x3, 0x5, 0x1, 0x7fffffffffffffff, 0x1, 0x2, 0xa2a, 0x7, 0x8001, 0x6, 0x1, 0xd6, 0xffff, 0x3]}) 09:01:21 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 47) 09:01:21 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x800003b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0x4, {0x5f, 0x3ff, 0x800, 0xfffffff8, 0x2, 0x4}}) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f00000000c0)) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20080, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x800003b, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0x4, {0x5f, 0x3ff, 0x800, 0xfffffff8, 0x2, 0x4}}) (async) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f00000000c0)) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x20080, 0x0) (async) 09:01:21 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async, rerun: 64) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff0100ffffff002008"], 0x1c}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) 09:01:21 executing program 2: r0 = getuid() (async) r1 = getuid() setresuid(r0, r1, 0xee00) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x140) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0xfff) setresuid(0xee00, 0xee01, r0) (async, rerun: 64) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 64) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000100)=""/103, 0x67}, {&(0x7f0000000180)=""/94, 0x5e}], 0x2}, 0x40000100) 09:01:21 executing program 1: ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:21 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x5, 0xa, 0x4009) (async) recvmmsg$unix(r0, &(0x7f0000000b40)=[{{&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000280)=""/84, 0x54}], 0x1, &(0x7f0000000340)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}, {{&(0x7f0000000440)=@abs, 0x6e, &(0x7f0000000780)=[{&(0x7f00000004c0)=""/87, 0x57}, {&(0x7f0000000540)=""/151, 0x97}, {&(0x7f0000000600)=""/183, 0xb7}, {&(0x7f00000006c0)=""/180, 0xb4}], 0x4, &(0x7f00000007c0)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000800)=@abs, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000880)=""/122, 0x7a}, {&(0x7f0000000900)=""/119, 0x77}], 0x2, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x148}}], 0x3, 0x101, &(0x7f0000000c00)) (async, rerun: 32) r1 = socket$inet_udplite(0x2, 0x2, 0x88) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'xfrm0\x00'}) (async) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000080)) (async) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x7, 0x8, 0x3, 0x5, 0x1, 0x7fffffffffffffff, 0x1, 0x2, 0xa2a, 0x7, 0x8001, 0x6, 0x1, 0xd6, 0xffff, 0x3]}) 09:01:21 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) setresuid(0xee00, 0xee00, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) clock_getres(0x2, &(0x7f0000000100)) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) 09:01:21 executing program 1: ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) [ 3408.134155] FAULT_INJECTION: forcing a failure. [ 3408.134155] name failslab, interval 1, probability 0, space 0, times 0 [ 3408.153503] CPU: 0 PID: 23454 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3408.161407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3408.170777] Call Trace: [ 3408.173365] dump_stack+0x1b2/0x281 [ 3408.176989] should_fail.cold+0x10a/0x149 09:01:21 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) (async, rerun: 64) getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) (rerun: 64) setresuid(0xee00, 0xee00, r0) (async, rerun: 64) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async, rerun: 64) clock_getres(0x2, &(0x7f0000000100)) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) [ 3408.181137] should_failslab+0xd6/0x130 [ 3408.185108] kmem_cache_alloc_node_trace+0x25a/0x400 [ 3408.190221] __kmalloc_node+0x38/0x70 [ 3408.194111] disk_expand_part_tbl+0x17a/0x340 [ 3408.198607] alloc_disk_node+0xf1/0x3d0 [ 3408.202582] loop_add+0x3cb/0x830 [ 3408.206045] ? loop_queue_rq+0x280/0x280 [ 3408.210105] ? loop_queue_work+0x21e0/0x21e0 [ 3408.214515] loop_control_ioctl+0x11a/0x3f0 [ 3408.218828] ? loop_lookup+0x190/0x190 [ 3408.222719] ? SyS_write+0x1b7/0x210 [ 3408.226433] ? loop_lookup+0x190/0x190 [ 3408.230329] do_vfs_ioctl+0x75a/0xff0 09:01:21 executing program 2: setresuid(0x0, 0xee01, 0x0) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) setresuid(0xee00, 0xee00, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) clock_getres(0x2, &(0x7f0000000100)) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) setresuid(0x0, 0xee01, 0x0) (async) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) (async) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) (async) setresuid(0xee00, 0xee00, r0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) clock_getres(0x2, &(0x7f0000000100)) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) (async) 09:01:21 executing program 2: r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, r0, 0x10, 0x7fffffff, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @rand_addr=' \x01\x00'}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PEER_V6={0x14, 0x9, @empty}]}, 0x88}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3408.234132] ? lock_acquire+0x170/0x3f0 [ 3408.238102] ? ioctl_preallocate+0x1a0/0x1a0 [ 3408.242507] ? __fget+0x265/0x3e0 [ 3408.245958] ? do_vfs_ioctl+0xff0/0xff0 [ 3408.249926] ? security_file_ioctl+0x83/0xb0 [ 3408.254329] SyS_ioctl+0x7f/0xb0 [ 3408.257687] ? do_vfs_ioctl+0xff0/0xff0 [ 3408.261655] do_syscall_64+0x1d5/0x640 [ 3408.265542] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3408.270725] RIP: 0033:0x7f0bff8e60c9 [ 3408.274426] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:01:21 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 48) 09:01:21 executing program 2: r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, r0, 0x10, 0x7fffffff, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @rand_addr=' \x01\x00'}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PEER_V6={0x14, 0x9, @empty}]}, 0x88}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, r0, 0x10, 0x7fffffff, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @rand_addr=' \x01\x00'}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PEER_V6={0x14, 0x9, @empty}]}, 0x88}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) [ 3408.282127] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3408.289395] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3408.296662] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3408.303925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3408.311181] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 09:01:21 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) pipe(&(0x7f0000000ac0)) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r0) (async) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) (async) 09:01:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff0100ffffff002008"], 0x1c}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff0100ffffff002008"], 0x1c}}, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) (async) 09:01:21 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:21 executing program 1: ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) (async) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) (async) 09:01:21 executing program 2: r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, r0, 0x10, 0x7fffffff, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @rand_addr=' \x01\x00'}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PEER_V6={0x14, 0x9, @empty}]}, 0x88}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) setresuid(0x0, 0xee01, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, r0, 0x10, 0x7fffffff, 0x25dfdbff, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @rand_addr=' \x01\x00'}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PEER_V6={0x14, 0x9, @empty}]}, 0x88}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) (async) setresuid(0x0, 0xee01, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) [ 3408.426990] FAULT_INJECTION: forcing a failure. [ 3408.426990] name failslab, interval 1, probability 0, space 0, times 0 [ 3408.461463] CPU: 1 PID: 23495 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 09:01:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffff0100ffffff002008"], 0x1c}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) [ 3408.469371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3408.478811] Call Trace: [ 3408.481400] dump_stack+0x1b2/0x281 [ 3408.485030] should_fail.cold+0x10a/0x149 [ 3408.489275] should_failslab+0xd6/0x130 [ 3408.493254] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3408.497922] rand_initialize_disk+0x46/0xa9 [ 3408.502243] alloc_disk_node+0x1f7/0x3d0 [ 3408.506301] loop_add+0x3cb/0x830 [ 3408.509756] ? loop_queue_rq+0x280/0x280 [ 3408.513830] ? loop_queue_work+0x21e0/0x21e0 [ 3408.518234] loop_control_ioctl+0x11a/0x3f0 [ 3408.522531] ? loop_lookup+0x190/0x190 [ 3408.526397] ? SyS_write+0x1b7/0x210 [ 3408.530088] ? loop_lookup+0x190/0x190 [ 3408.533968] do_vfs_ioctl+0x75a/0xff0 [ 3408.538099] ? lock_acquire+0x170/0x3f0 [ 3408.542076] ? ioctl_preallocate+0x1a0/0x1a0 [ 3408.546497] ? __fget+0x265/0x3e0 [ 3408.549948] ? do_vfs_ioctl+0xff0/0xff0 [ 3408.553903] ? security_file_ioctl+0x83/0xb0 [ 3408.558298] SyS_ioctl+0x7f/0xb0 [ 3408.561640] ? do_vfs_ioctl+0xff0/0xff0 [ 3408.565590] do_syscall_64+0x1d5/0x640 [ 3408.569459] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 09:01:21 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000002440)=[{&(0x7f0000000100)=""/203, 0xcb}, {&(0x7f0000000200)=""/122, 0x7a}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/146, 0x92}, {&(0x7f0000001340)=""/204, 0xcc}, {&(0x7f0000001440)=""/4096, 0x1000}], 0x6}, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:21 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) (fail_nth: 49) [ 3408.575060] RIP: 0033:0x7f0bff8e60c9 [ 3408.578850] RSP: 002b:00007f0bfde37168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3408.586536] RAX: ffffffffffffffda RBX: 00007f0bffa06050 RCX: 00007f0bff8e60c9 [ 3408.593786] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3408.601036] RBP: 00007f0bfde371d0 R08: 0000000000000000 R09: 0000000000000000 [ 3408.608291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3408.615626] R13: 00007ffce046c59f R14: 00007f0bfde37300 R15: 0000000000022000 09:01:21 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000002440)=[{&(0x7f0000000100)=""/203, 0xcb}, {&(0x7f0000000200)=""/122, 0x7a}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/146, 0x92}, {&(0x7f0000001340)=""/204, 0xcc}, {&(0x7f0000001440)=""/4096, 0x1000}], 0x6}, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) 09:01:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) 09:01:22 executing program 2: setresuid(0x0, 0xee01, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000002440)=[{&(0x7f0000000100)=""/203, 0xcb}, {&(0x7f0000000200)=""/122, 0x7a}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/146, 0x92}, {&(0x7f0000001340)=""/204, 0xcc}, {&(0x7f0000001440)=""/4096, 0x1000}], 0x6}, 0x0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) setresuid(0x0, 0xee01, 0x0) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000002440)=[{&(0x7f0000000100)=""/203, 0xcb}, {&(0x7f0000000200)=""/122, 0x7a}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/146, 0x92}, {&(0x7f0000001340)=""/204, 0xcc}, {&(0x7f0000001440)=""/4096, 0x1000}], 0x6}, 0x0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) 09:01:22 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000140)) 09:01:22 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) socket(0x0, 0x80000, 0x9) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 09:01:22 executing program 1: ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000000)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000080)={r0}) syz_open_dev$loop(&(0x7f0000000040), 0x3b, 0x0) 09:01:22 executing program 2: r0 = getuid() setresuid(0x0, 0xee01, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) ioctl$SNDCTL_TMR_SELECT(0xffffffffffffffff, 0x40045408) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"6b6d85d453cb0f44f0b176cf4ad849104d821893c23111b1b7935e2cda354dfb5c6e7c5b4622c9565276cdc0abb1d06437f6cbe7dd790acbcb24afbce6bd578e3f54b2d6219b4e5a404b7954cc2431951071316acf5d6dec9bb36956f99bce6f037d9e14ed6163a9027a3e080ee7d417b6159cb6ab9cb91c1688f7c499ff4cd3b10a72df5c81529af1668f83007a52537d03d6ded6a19e78c2f7781a8e87b4584880c73a085dc9668afd5e953e4de591a2ca905d286ac61f68d31421fbb60c38cfd982c839f0792998bc833ae2203306243ae1b006d20106968d382d83b182324e15d88489ec0798a7d5326483cf565e7a416a5430a2a81d449703fb1b41560dad267f7c2d15797c51c0e5754b94b9752851e6a5255712442b512a4c2b7b25fc897d21320401ac08aa56a4fafd171715388000fc58e8e4293c023131b802cd4fb5c170320422871d06989b25d1fc3e2b3d8d3b0c6a9324ccb97ba55ad475a6db262a1cb62412cc817d8d60d724d28665178b5bbaa7d4a7b0e6cf6019cd8ec127c0a0daeff28dbfcbbfb6f323b0d9c2009b9b46023bafa9e93364ec7bc0b7bcbe3872496af18c58102764fae1c6513baa2e9afef04ad7c72935fe41ca7f6b519e41136c2c2ec17bca7f1d66a59e5b25b97cda1eebcef41c90042c5c5f2c58039fba1087224b9364b8f57b72c50e27a1a7c72524e85f96bd00f6d6aca407cea2d7159d8ee4095d9b35593afba9ebe54e149b22fc79c1d037a8249706edc59429706d3a01c81e8561a7191124835ff7898a77df5986e5a294b97e776b205faab2547f11a59566b96004a7d9bd4d312f2f9215a9c48f247d35d1e3a8890f807838a998c3628fd77ad8157d2f4bef331d85f35e3fbedfe835c38414dbb93a0c72cee3d394e7a1dd712bf927b4900ccb9ef2f91e8b88b768fd598bef6f73dae1086702544d71689d8a09ea35adb9b8a0f24ccc2f6adc18c85f79f4c491bbf37c95c03e28ccaeec51ad81c9a473074fb1548308b3dec918c9e7de925376e100a4eb2ed7c3efba7b6d208f0df693af5cda7fac80a290ee5ec4ea0b27af6e96004cc37fe9278f602c4529fd48fe546cebf2ec5f44a1a5fab64fd07d04096d5bf75ff71e1dee1eeb35693af9d064a8d2e90df89a4daa4feb089b1f8bf735523ea835e22ad8a04f63e372ec3a3b8fb0dbeeefb5082d95e966d5370fd7a59cabd4d88e873dddb89525f1a59efa8692c91ed4a43aed60fa7f6987e6eabe0366a87b776a591a0f717f72c3e1943d6ddab9d6b65224870763d4903f89c29a67fc58e6490e98eda8bb8ebe8cd9ef1b60238b9444d71f33a58f9059dcfbc156c266da078d2d46cd73f74c21002b95e0f6812468dfc603fad7c9838756c0f85e6799058dd5de737b43a88dcdbca588b29d49479a92da67ebc9720af1f52a170ac272e30f7013973de5"}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x80}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x8080) [ 3408.765649] FAULT_INJECTION: forcing a failure. [ 3408.765649] name failslab, interval 1, probability 0, space 0, times 0 [ 3408.810068] CPU: 1 PID: 23539 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3408.817970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 3408.827317] Call Trace: [ 3408.829900] dump_stack+0x1b2/0x281 [ 3408.833526] should_fail.cold+0x10a/0x149 [ 3408.837678] should_failslab+0xd6/0x130 [ 3408.841661] kmem_cache_alloc_trace+0x29a/0x3d0 [ 3408.846325] ? __lock_acquire+0x5fc/0x3f20 [ 3408.850556] device_create_groups_vargs+0x7b/0x250 [ 3408.855486] device_create_vargs+0x3a/0x50 [ 3408.859719] bdi_register_va.part.0+0x35/0x650 [ 3408.864309] bdi_register+0x101/0x110 [ 3408.868094] ? bdi_register_va+0x80/0x80 [ 3408.872132] ? vsnprintf+0x260/0x1340 [ 3408.875909] bdi_register_owner+0x59/0xf0 [ 3408.880036] device_add_disk+0x5bb/0xdc0 [ 3408.884076] ? sprintf+0xa7/0xd0 [ 3408.887431] ? blk_alloc_devt+0x310/0x310 [ 3408.891561] ? __lockdep_init_map+0x100/0x560 [ 3408.896032] ? __lockdep_init_map+0x100/0x560 [ 3408.900502] loop_add+0x615/0x830 [ 3408.903935] ? loop_queue_rq+0x280/0x280 [ 3408.907975] ? loop_queue_work+0x21e0/0x21e0 [ 3408.912360] loop_control_ioctl+0x11a/0x3f0 [ 3408.916659] ? loop_lookup+0x190/0x190 [ 3408.920522] ? SyS_write+0x1b7/0x210 [ 3408.924217] ? loop_lookup+0x190/0x190 [ 3408.928093] do_vfs_ioctl+0x75a/0xff0 [ 3408.931881] ? lock_acquire+0x170/0x3f0 [ 3408.935843] ? ioctl_preallocate+0x1a0/0x1a0 [ 3408.940231] ? __fget+0x265/0x3e0 [ 3408.943660] ? do_vfs_ioctl+0xff0/0xff0 [ 3408.947611] ? security_file_ioctl+0x83/0xb0 [ 3408.951997] SyS_ioctl+0x7f/0xb0 [ 3408.955347] ? do_vfs_ioctl+0xff0/0xff0 [ 3408.959306] do_syscall_64+0x1d5/0x640 [ 3408.963178] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3408.968346] RIP: 0033:0x7f0bff8e60c9 [ 3408.972029] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3408.979736] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3408.986983] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3408.994317] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3409.001735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 09:01:22 executing program 2: r0 = getuid() setresuid(0x0, 0xee01, r0) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$SNDCTL_TMR_SELECT(0xffffffffffffffff, 0x40045408) (async) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"6b6d85d453cb0f44f0b176cf4ad849104d821893c23111b1b7935e2cda354dfb5c6e7c5b4622c9565276cdc0abb1d06437f6cbe7dd790acbcb24afbce6bd578e3f54b2d6219b4e5a404b7954cc2431951071316acf5d6dec9bb36956f99bce6f037d9e14ed6163a9027a3e080ee7d417b6159cb6ab9cb91c1688f7c499ff4cd3b10a72df5c81529af1668f83007a52537d03d6ded6a19e78c2f7781a8e87b4584880c73a085dc9668afd5e953e4de591a2ca905d286ac61f68d31421fbb60c38cfd982c839f0792998bc833ae2203306243ae1b006d20106968d382d83b182324e15d88489ec0798a7d5326483cf565e7a416a5430a2a81d449703fb1b41560dad267f7c2d15797c51c0e5754b94b9752851e6a5255712442b512a4c2b7b25fc897d21320401ac08aa56a4fafd171715388000fc58e8e4293c023131b802cd4fb5c170320422871d06989b25d1fc3e2b3d8d3b0c6a9324ccb97ba55ad475a6db262a1cb62412cc817d8d60d724d28665178b5bbaa7d4a7b0e6cf6019cd8ec127c0a0daeff28dbfcbbfb6f323b0d9c2009b9b46023bafa9e93364ec7bc0b7bcbe3872496af18c58102764fae1c6513baa2e9afef04ad7c72935fe41ca7f6b519e41136c2c2ec17bca7f1d66a59e5b25b97cda1eebcef41c90042c5c5f2c58039fba1087224b9364b8f57b72c50e27a1a7c72524e85f96bd00f6d6aca407cea2d7159d8ee4095d9b35593afba9ebe54e149b22fc79c1d037a8249706edc59429706d3a01c81e8561a7191124835ff7898a77df5986e5a294b97e776b205faab2547f11a59566b96004a7d9bd4d312f2f9215a9c48f247d35d1e3a8890f807838a998c3628fd77ad8157d2f4bef331d85f35e3fbedfe835c38414dbb93a0c72cee3d394e7a1dd712bf927b4900ccb9ef2f91e8b88b768fd598bef6f73dae1086702544d71689d8a09ea35adb9b8a0f24ccc2f6adc18c85f79f4c491bbf37c95c03e28ccaeec51ad81c9a473074fb1548308b3dec918c9e7de925376e100a4eb2ed7c3efba7b6d208f0df693af5cda7fac80a290ee5ec4ea0b27af6e96004cc37fe9278f602c4529fd48fe546cebf2ec5f44a1a5fab64fd07d04096d5bf75ff71e1dee1eeb35693af9d064a8d2e90df89a4daa4feb089b1f8bf735523ea835e22ad8a04f63e372ec3a3b8fb0dbeeefb5082d95e966d5370fd7a59cabd4d88e873dddb89525f1a59efa8692c91ed4a43aed60fa7f6987e6eabe0366a87b776a591a0f717f72c3e1943d6ddab9d6b65224870763d4903f89c29a67fc58e6490e98eda8bb8ebe8cd9ef1b60238b9444d71f33a58f9059dcfbc156c266da078d2d46cd73f74c21002b95e0f6812468dfc603fad7c9838756c0f85e6799058dd5de737b43a88dcdbca588b29d49479a92da67ebc9720af1f52a170ac272e30f7013973de5"}) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), 0xffffffffffffffff) (async) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x80}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x8080) 09:01:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="fbffffffffffffff002008"], 0x1c}}, 0x0) (async) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) [ 3409.008982] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3409.020237] kasan: CONFIG_KASAN_INLINE enabled [ 3409.025076] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 3409.032525] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 3409.038743] Modules linked in: [ 3409.041928] CPU: 1 PID: 23539 Comm: syz-executor.3 Not tainted 4.14.302-syzkaller #0 [ 3409.049791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 09:01:22 executing program 2: r0 = getuid() setresuid(0x0, 0xee01, r0) (async) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) (async) ioctl$SNDCTL_TMR_SELECT(0xffffffffffffffff, 0x40045408) (async) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000080)={"6b6d85d453cb0f44f0b176cf4ad849104d821893c23111b1b7935e2cda354dfb5c6e7c5b4622c9565276cdc0abb1d06437f6cbe7dd790acbcb24afbce6bd578e3f54b2d6219b4e5a404b7954cc2431951071316acf5d6dec9bb36956f99bce6f037d9e14ed6163a9027a3e080ee7d417b6159cb6ab9cb91c1688f7c499ff4cd3b10a72df5c81529af1668f83007a52537d03d6ded6a19e78c2f7781a8e87b4584880c73a085dc9668afd5e953e4de591a2ca905d286ac61f68d31421fbb60c38cfd982c839f0792998bc833ae2203306243ae1b006d20106968d382d83b182324e15d88489ec0798a7d5326483cf565e7a416a5430a2a81d449703fb1b41560dad267f7c2d15797c51c0e5754b94b9752851e6a5255712442b512a4c2b7b25fc897d21320401ac08aa56a4fafd171715388000fc58e8e4293c023131b802cd4fb5c170320422871d06989b25d1fc3e2b3d8d3b0c6a9324ccb97ba55ad475a6db262a1cb62412cc817d8d60d724d28665178b5bbaa7d4a7b0e6cf6019cd8ec127c0a0daeff28dbfcbbfb6f323b0d9c2009b9b46023bafa9e93364ec7bc0b7bcbe3872496af18c58102764fae1c6513baa2e9afef04ad7c72935fe41ca7f6b519e41136c2c2ec17bca7f1d66a59e5b25b97cda1eebcef41c90042c5c5f2c58039fba1087224b9364b8f57b72c50e27a1a7c72524e85f96bd00f6d6aca407cea2d7159d8ee4095d9b35593afba9ebe54e149b22fc79c1d037a8249706edc59429706d3a01c81e8561a7191124835ff7898a77df5986e5a294b97e776b205faab2547f11a59566b96004a7d9bd4d312f2f9215a9c48f247d35d1e3a8890f807838a998c3628fd77ad8157d2f4bef331d85f35e3fbedfe835c38414dbb93a0c72cee3d394e7a1dd712bf927b4900ccb9ef2f91e8b88b768fd598bef6f73dae1086702544d71689d8a09ea35adb9b8a0f24ccc2f6adc18c85f79f4c491bbf37c95c03e28ccaeec51ad81c9a473074fb1548308b3dec918c9e7de925376e100a4eb2ed7c3efba7b6d208f0df693af5cda7fac80a290ee5ec4ea0b27af6e96004cc37fe9278f602c4529fd48fe546cebf2ec5f44a1a5fab64fd07d04096d5bf75ff71e1dee1eeb35693af9d064a8d2e90df89a4daa4feb089b1f8bf735523ea835e22ad8a04f63e372ec3a3b8fb0dbeeefb5082d95e966d5370fd7a59cabd4d88e873dddb89525f1a59efa8692c91ed4a43aed60fa7f6987e6eabe0366a87b776a591a0f717f72c3e1943d6ddab9d6b65224870763d4903f89c29a67fc58e6490e98eda8bb8ebe8cd9ef1b60238b9444d71f33a58f9059dcfbc156c266da078d2d46cd73f74c21002b95e0f6812468dfc603fad7c9838756c0f85e6799058dd5de737b43a88dcdbca588b29d49479a92da67ebc9720af1f52a170ac272e30f7013973de5"}) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r1) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), 0xffffffffffffffff) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r3) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x80}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x8080) 09:01:22 executing program 2: r0 = getuid() r1 = getuid() setresuid(r0, r1, 0xee00) r2 = getuid() getuid() r3 = getuid() r4 = getuid() r5 = getuid() r6 = getuid() setresuid(r5, r6, 0xee00) setresuid(r4, r3, 0xee00) getresuid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) getresuid(&(0x7f0000000100)=0x0, &(0x7f0000000140), &(0x7f0000000280)) r8 = getuid() r9 = getuid() getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) setresuid(r8, r9, 0xee00) setresuid(r2, r7, r8) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2\x00', 0x1ff) [ 3409.059133] task: ffff888098d78580 task.stack: ffff8880a1658000 [ 3409.065180] RIP: 0010:sysfs_do_create_link_sd+0x56/0x120 [ 3409.070610] RSP: 0018:ffff8880a165fb48 EFLAGS: 00010202 [ 3409.075967] RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000007c31 [ 3409.083228] RDX: 0000000000000008 RSI: 0000000000000001 RDI: 0000000000000040 [ 3409.090489] RBP: ffffffff87cbd660 R08: ffffffff8b9e1c88 R09: 00000000000400ca [ 3409.097749] R10: ffff888098d78e30 R11: ffff888098d78580 R12: ffff88809c1a4e00 [ 3409.105010] R13: ffffffff87cbd660 R14: 0000000000000001 R15: ffff88809537aa5c [ 3409.112297] FS: 00007f0bfde58700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 [ 3409.120513] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3409.126383] CR2: 00007fb36ba7c988 CR3: 00000000aaeb0000 CR4: 00000000003406e0 [ 3409.133647] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3409.140904] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3409.148155] Call Trace: [ 3409.150721] sysfs_create_link+0x5f/0xc0 [ 3409.154761] device_add_disk+0x9f8/0xdc0 [ 3409.158802] ? sprintf+0xa7/0xd0 [ 3409.162139] ? blk_alloc_devt+0x310/0x310 [ 3409.166260] ? __lockdep_init_map+0x100/0x560 [ 3409.170730] ? __lockdep_init_map+0x100/0x560 [ 3409.175199] loop_add+0x615/0x830 [ 3409.178628] ? loop_queue_rq+0x280/0x280 [ 3409.182663] ? loop_queue_work+0x21e0/0x21e0 [ 3409.187218] loop_control_ioctl+0x11a/0x3f0 [ 3409.191513] ? loop_lookup+0x190/0x190 [ 3409.195376] ? SyS_write+0x1b7/0x210 [ 3409.199062] ? loop_lookup+0x190/0x190 [ 3409.202922] do_vfs_ioctl+0x75a/0xff0 [ 3409.206696] ? lock_acquire+0x170/0x3f0 [ 3409.210640] ? ioctl_preallocate+0x1a0/0x1a0 [ 3409.215020] ? __fget+0x265/0x3e0 [ 3409.218448] ? do_vfs_ioctl+0xff0/0xff0 [ 3409.222396] ? security_file_ioctl+0x83/0xb0 [ 3409.226776] SyS_ioctl+0x7f/0xb0 [ 3409.230116] ? do_vfs_ioctl+0xff0/0xff0 [ 3409.234064] do_syscall_64+0x1d5/0x640 [ 3409.237926] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 3409.243088] RIP: 0033:0x7f0bff8e60c9 [ 3409.246775] RSP: 002b:00007f0bfde58168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3409.254464] RAX: ffffffffffffffda RBX: 00007f0bffa05f80 RCX: 00007f0bff8e60c9 [ 3409.261712] RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 3409.268955] RBP: 00007f0bfde581d0 R08: 0000000000000000 R09: 0000000000000000 [ 3409.276371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3409.283612] R13: 00007ffce046c59f R14: 00007f0bfde58300 R15: 0000000000022000 [ 3409.290862] Code: 84 a1 00 00 00 e8 1b 4d b1 ff 48 c7 c7 c0 d8 04 89 e8 af b9 80 05 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a7 00 00 00 4c 8b 6b 30 4d 85 ed 74 4f e8 e2 [ 3409.309953] RIP: sysfs_do_create_link_sd+0x56/0x120 RSP: ffff8880a165fb48 [ 3409.317056] ---[ end trace 63cf7bd190b2ca6d ]--- [ 3409.321800] Kernel panic - not syncing: Fatal exception [ 3409.327305] Kernel Offset: disabled [ 3409.330910] Rebooting in 86400 seconds..