NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x30, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x840) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r4, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x743b}]}, 0x20}, 0x1, 0x0, 0x0, 0x70c18f1512da662a}, 0x8000) (async) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f00000004c0)='IPVS\x00', &(0x7f0000000500)='./file0\x00', 0xffffffffffffffff) (rerun: 64) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000380)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x94, r4, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x10000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4084}, 0x4005) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x11, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x30, 0xd0001) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000be99", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f00000001c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}}}, 0x30) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000080)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x401, 0x5, {"b9372d8ce3723e6ab32b20d19f330fbb"}, 0x800, 0x5e7b, 0x7fffffffffffffff}}}, 0x90) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x11, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x30, 0xd0001) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000be99", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f00000001c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}}}, 0x30) (async) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000080)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x401, 0x5, {"b9372d8ce3723e6ab32b20d19f330fbb"}, 0x800, 0x5e7b, 0x7fffffffffffffff}}}, 0x90) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:52 executing program 3: write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x4b, 0x2}, 0x7) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdc02, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x20008090) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000100)={0x4, 0x8, 0xfa00, {r4, 0x2}}, 0x10) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000540)={0x3, 0x0, &(0x7f0000000500)=[0xffffffffffffffff, r4, r5, r1, r6]}, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0x6) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r7, 0xac}}, 0x10) r8 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r8, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="080db6330d7beca053e2894446414a6b00010000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='d\x00\x00\b', @ANYRES16=r2, @ANYBLOB="010028bd7000ffdbdf2500000000080018000a0101000600030007000000"], 0x24}, 0x1, 0x0, 0x0, 0x4008001}, 0x8010) (async) mq_timedreceive(r1, &(0x7f0000000540)=""/237, 0xed, 0x8000, &(0x7f0000000640)={0x0, 0x3938700}) (async) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000040)='/dev/vcs#\x00', 0x0, r0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x30, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x840) (async) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r4, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x743b}]}, 0x20}, 0x1, 0x0, 0x0, 0x70c18f1512da662a}, 0x8000) (async) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f00000004c0)='IPVS\x00', &(0x7f0000000500)='./file0\x00', 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000380)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x94, r4, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x10000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4084}, 0x4005) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x2, @private0, 0x7}, {0xa, 0x4e20, 0x7, @loopback, 0x4}, 0xffffffffffffffff, 0x9dd5}}, 0x48) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffd, &(0x7f0000000140)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:52 executing program 3: write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x4b, 0x2}, 0x7) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdc02, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x20008090) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000100)={0x4, 0x8, 0xfa00, {r4, 0x2}}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdc02, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x20008090) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080), 0x13f, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000100)={0x4, 0x8, 0xfa00, {r4, 0x2}}, 0x10) (async) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f0000000540)={0x3, 0x0, &(0x7f0000000500)=[0xffffffffffffffff, r3, r4, r0, r5]}, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r6}}, 0x6) r7 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r7, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x2, @private0, 0x7}, {0xa, 0x4e20, 0x7, @loopback, 0x4}, 0xffffffffffffffff, 0x9dd5}}, 0x48) (async) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffd, &(0x7f0000000140)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:52 executing program 3: write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) (async) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x4b, 0x2}, 0x7) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdc02, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x20008090) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000100)={0x4, 0x8, 0xfa00, {r4, 0x2}}, 0x10) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f0000000540)={0x3, 0x0, &(0x7f0000000500)=[0xffffffffffffffff, r3, r4, r0, r5]}, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) r6 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r6, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000100), 0x7, 0x2cac2) socket$packet(0x11, 0x2, 0x300) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f00000000c0)=',}.&\x00', 0x0, r0) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$tipc(r1, &(0x7f0000000080)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x4}}, 0x10) 20:03:52 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x10010, 0xffffffffffffffff, 0x80000000) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x2, @private0, 0x7}, {0xa, 0x4e20, 0x7, @loopback, 0x4}, 0xffffffffffffffff, 0x9dd5}}, 0x48) (async, rerun: 32) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffd, &(0x7f0000000140)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000540)={0x3, 0x0, &(0x7f0000000500)=[0xffffffffffffffff, r2, r3, r0, r4]}, 0x5) r5 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r5, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x38, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$tcp_mem(r3, &(0x7f0000000080)={0x7, 0x20, 0x4, 0x20, 0x8}, 0x48) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000100), 0x7, 0x2cac2) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f00000000c0)=',}.&\x00', 0x0, r0) (async, rerun: 64) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$tipc(r1, &(0x7f0000000080)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x4}}, 0x10) 20:03:52 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x10010, 0xffffffffffffffff, 0x80000000) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x38, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$tcp_mem(r3, &(0x7f0000000080)={0x7, 0x20, 0x4, 0x20, 0x8}, 0x48) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000100), 0x7, 0x2cac2) socket$packet(0x11, 0x2, 0x300) (async) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f00000000c0)=',}.&\x00', 0x0, r0) (async) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$tipc(r1, &(0x7f0000000080)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x4}}, 0x10) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x38, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$tcp_mem(r3, &(0x7f0000000080)={0x7, 0x20, 0x4, 0x20, 0x8}, 0x48) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x10010, 0xffffffffffffffff, 0x80000000) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x3}}, 0x18) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x74, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x800}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '*'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xd}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1000000000000000}]}, 0x74}}, 0x80) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x3}}, 0x18) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x74, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x800}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '*'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xd}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1000000000000000}]}, 0x74}}, 0x80) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$tcp_mem(r0, &(0x7f0000000180)={0x8, 0x20, 0x401, 0x20, 0x7fffffffffffffff}, 0x48) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, 0x0, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8c8}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x70}}, 0x20040090) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010001000c0002fa0500000000fffffffe00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r5 = socket$packet(0x11, 0x29a42f911499c8ea, 0x300) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) r9 = fsmount(r3, 0x1, 0x0) write$RDMA_USER_CM_CMD_REJECT(r9, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {r2, 0x8, "ad8335", "356dccc4d672d12945b8ef0d0a122a437b4efa1ea26ce25c7bad0c18f6b5560498d582b672a82454fc6617fc712006ff393149958478e1d2ec77e601eb894e45c971fda05dcac0bff11d5d3ed8def2aad9dff3e2e383fd54b6eec37bc9f35f6bc4e940054c4cdf5558dbddd78e18807f5a7e75756f0756f14f62a95b45b33104768c26ab54f5ac215623a6b054a3bdb8811fd24b478643c4e57b921796d550c8b14e1413b05e2c1600c76d0f77b168c1bdb0ecf5802ebd08a2cbb5af3987bf4a82a3245be893af92ce02847434988b0ebccd6d0d397a26e76377077c6a0e677ab3d4b4d261d84596d80faf588cd1ad17e2b1fef52f88793eb8d0b98ff8315286"}}, 0x110) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000100)={0x8, 0x0, &(0x7f00000000c0)=[r0, r1, r1, r4, r5, r0, r6, r7, r8]}, 0x9) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x3}}, 0x18) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async, rerun: 32) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) (async, rerun: 32) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x74, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x800}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '*'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xd}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1000000000000000}]}, 0x74}}, 0x80) 20:03:52 executing program 3: syz_io_uring_setup(0x68e7, &(0x7f0000000100)={0x0, 0xfca3, 0x1, 0x3, 0x244}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f00000000c0)={0xf, 0x1f, 0x2, 0x5}, 0xf) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000000040), &(0x7f0000000080)=0x4) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$tcp_mem(r0, &(0x7f0000000180)={0x8, 0x20, 0x401, 0x20, 0x7fffffffffffffff}, 0x48) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, 0x0, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8c8}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x70}}, 0x20040090) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r7 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010001000c0002fa0500000000fffffffe00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r5 = socket$packet(0x11, 0x29a42f911499c8ea, 0x300) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) r9 = fsmount(r3, 0x1, 0x0) write$RDMA_USER_CM_CMD_REJECT(r9, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {r2, 0x8, "ad8335", "356dccc4d672d12945b8ef0d0a122a437b4efa1ea26ce25c7bad0c18f6b5560498d582b672a82454fc6617fc712006ff393149958478e1d2ec77e601eb894e45c971fda05dcac0bff11d5d3ed8def2aad9dff3e2e383fd54b6eec37bc9f35f6bc4e940054c4cdf5558dbddd78e18807f5a7e75756f0756f14f62a95b45b33104768c26ab54f5ac215623a6b054a3bdb8811fd24b478643c4e57b921796d550c8b14e1413b05e2c1600c76d0f77b168c1bdb0ecf5802ebd08a2cbb5af3987bf4a82a3245be893af92ce02847434988b0ebccd6d0d397a26e76377077c6a0e677ab3d4b4d261d84596d80faf588cd1ad17e2b1fef52f88793eb8d0b98ff8315286"}}, 0x110) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000100)={0x8, 0x0, &(0x7f00000000c0)=[r0, r1, r1, r4, r5, r0, r6, r7, r8]}, 0x9) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010001000c0002fa0500000000fffffffe00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) socket$packet(0x11, 0x29a42f911499c8ea, 0x300) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) fsmount(r3, 0x1, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(r9, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {r2, 0x8, "ad8335", "356dccc4d672d12945b8ef0d0a122a437b4efa1ea26ce25c7bad0c18f6b5560498d582b672a82454fc6617fc712006ff393149958478e1d2ec77e601eb894e45c971fda05dcac0bff11d5d3ed8def2aad9dff3e2e383fd54b6eec37bc9f35f6bc4e940054c4cdf5558dbddd78e18807f5a7e75756f0756f14f62a95b45b33104768c26ab54f5ac215623a6b054a3bdb8811fd24b478643c4e57b921796d550c8b14e1413b05e2c1600c76d0f77b168c1bdb0ecf5802ebd08a2cbb5af3987bf4a82a3245be893af92ce02847434988b0ebccd6d0d397a26e76377077c6a0e677ab3d4b4d261d84596d80faf588cd1ad17e2b1fef52f88793eb8d0b98ff8315286"}}, 0x110) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000100)={0x8, 0x0, &(0x7f00000000c0)=[r0, r1, r1, r4, r5, r0, r6, r7, r8]}, 0x9) (async) 20:03:52 executing program 3: syz_io_uring_setup(0x68e7, &(0x7f0000000100)={0x0, 0xfca3, 0x1, 0x3, 0x244}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f00000000c0)={0xf, 0x1f, 0x2, 0x5}, 0xf) (async) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000000040), &(0x7f0000000080)=0x4) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) (async) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) r7 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$tcp_mem(r0, &(0x7f0000000180)={0x8, 0x20, 0x401, 0x20, 0x7fffffffffffffff}, 0x48) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, 0x0, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8c8}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x70}}, 0x20040090) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$tcp_mem(r0, &(0x7f0000000180)={0x8, 0x20, 0x401, 0x20, 0x7fffffffffffffff}, 0x48) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, 0x0, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8c8}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x70}}, 0x20040090) (async) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 3: syz_io_uring_setup(0x68e7, &(0x7f0000000100)={0x0, 0xfca3, 0x1, 0x3, 0x244}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f00000000c0)={0xf, 0x1f, 0x2, 0x5}, 0xf) (async) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000000040), &(0x7f0000000080)=0x4) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r7 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) fsmount(0xffffffffffffffff, 0x0, 0x0) (async) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) (async) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010001000c0002fa0500000000fffffffe00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) r5 = socket$packet(0x11, 0x29a42f911499c8ea, 0x300) (async, rerun: 64) r6 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) r9 = fsmount(r3, 0x1, 0x0) write$RDMA_USER_CM_CMD_REJECT(r9, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {r2, 0x8, "ad8335", "356dccc4d672d12945b8ef0d0a122a437b4efa1ea26ce25c7bad0c18f6b5560498d582b672a82454fc6617fc712006ff393149958478e1d2ec77e601eb894e45c971fda05dcac0bff11d5d3ed8def2aad9dff3e2e383fd54b6eec37bc9f35f6bc4e940054c4cdf5558dbddd78e18807f5a7e75756f0756f14f62a95b45b33104768c26ab54f5ac215623a6b054a3bdb8811fd24b478643c4e57b921796d550c8b14e1413b05e2c1600c76d0f77b168c1bdb0ecf5802ebd08a2cbb5af3987bf4a82a3245be893af92ce02847434988b0ebccd6d0d397a26e76377077c6a0e677ab3d4b4d261d84596d80faf588cd1ad17e2b1fef52f88793eb8d0b98ff8315286"}}, 0x110) (async, rerun: 64) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000100)={0x8, 0x0, &(0x7f00000000c0)=[r0, r1, r1, r4, r5, r0, r6, r7, r8]}, 0x9) (rerun: 64) 20:03:52 executing program 0: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$tipc(r0, 0x0, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) syz_io_uring_setup(0x1d91, &(0x7f0000000100)={0x0, 0xa620, 0x10, 0x0, 0x0, 0x0, r4}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = fsmount(r2, 0x0, 0x84) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) syz_io_uring_submit(r5, 0x0, &(0x7f0000000080)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x3, {0x0, r7}, 0x8, 0x0, 0x0, {0x0, 0x0, r1}}, 0xffffffe0) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$tipc(r0, 0x0, 0x0) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_io_uring_setup(0x1d91, &(0x7f0000000100)={0x0, 0xa620, 0x10, 0x0, 0x0, 0x0, r4}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) (async) r6 = fsmount(r2, 0x0, 0x84) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) syz_io_uring_submit(r5, 0x0, &(0x7f0000000080)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x3, {0x0, r7}, 0x8, 0x0, 0x0, {0x0, 0x0, r1}}, 0xffffffe0) 20:03:52 executing program 3: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x2010, 0xffffffffffffffff, 0x80000000) sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200400c1}, 0x20044811) 20:03:52 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x100000000000002, 0x0, 0x111, 0x9}}, 0x20) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000480)={0x0, 0x3, 0x0, [0x7ff, 0xf, 0x1, 0x0, 0x4], [0x80000001, 0x9, 0x4, 0x8, 0x8, 0x7, 0x6, 0x8000000000000000, 0x4, 0x80, 0x401, 0x4, 0x2, 0x0, 0x9, 0xfffffffffffffff8, 0x8, 0xffffffff, 0x800, 0xffffffffd22d03a3, 0x6, 0x8, 0x8, 0xfff, 0x8, 0x8000000000000001, 0x9, 0x6c667f02, 0x3f, 0x7, 0xfffffffffffffffb, 0xc1, 0x81, 0x0, 0x6, 0x0, 0x1fc, 0x2, 0x1, 0xc16, 0x5, 0x5, 0x7fffffffffffffff, 0x40, 0x7, 0x4, 0x1ff, 0x4, 0x1, 0x2, 0xfffffffffffffe01, 0xfffffffffffffffc, 0x0, 0x6, 0x8000000000000001, 0x81, 0x8000000000000001, 0x101, 0x8, 0x2, 0x3, 0xe55, 0xfffffffffffffffd, 0x5, 0x80, 0x9, 0xffff, 0x6, 0x8000000000000001, 0x2, 0x200, 0x7a1559a0, 0x3669, 0x7fff, 0x6, 0x2, 0x8001, 0x7, 0x8000000000000001, 0x9, 0xfffffffffffffffa, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x80000001, 0x0, 0x8, 0xfffffffeffffffff, 0x2, 0xe8a, 0xb53, 0x6, 0x8000000000, 0x5, 0x1f, 0x5, 0x1f, 0x8b0, 0x10001, 0x100000000, 0x0, 0x1, 0x6, 0x7, 0x6, 0x80000001, 0x6, 0x6, 0x5, 0x4118069f, 0x3, 0x81, 0x7ff, 0xfff, 0x4, 0x80000001, 0x100, 0x8, 0x1ff, 0xb4]}) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000080), 0x200, 0x141002) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000000c0)=0x1, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r4 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r4, &(0x7f0000000180), &(0x7f00000001c0)=0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r3, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:52 executing program 3: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x2010, 0xffffffffffffffff, 0x80000000) (async) sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200400c1}, 0x20044811) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000080), 0x200, 0x141002) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000000c0)=0x1, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r4 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r4, &(0x7f0000000180), &(0x7f00000001c0)=0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r3, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:52 executing program 0: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$tipc(r0, 0x0, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) syz_io_uring_setup(0x1d91, &(0x7f0000000100)={0x0, 0xa620, 0x10, 0x0, 0x0, 0x0, r4}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = fsmount(r2, 0x0, 0x84) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) syz_io_uring_submit(r5, 0x0, &(0x7f0000000080)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x3, {0x0, r7}, 0x8, 0x0, 0x0, {0x0, 0x0, r1}}, 0xffffffe0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) (async) bind$tipc(r0, 0x0, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_io_uring_setup(0x1d91, &(0x7f0000000100)={0x0, 0xa620, 0x10, 0x0, 0x0, 0x0, r4}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) (async) fsmount(r2, 0x0, 0x84) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) syz_io_uring_submit(r5, 0x0, &(0x7f0000000080)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x3, {0x0, r7}, 0x8, 0x0, 0x0, {0x0, 0x0, r1}}, 0xffffffe0) (async) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x100000000000002, 0x0, 0x111, 0x9}}, 0x20) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000480)={0x0, 0x3, 0x0, [0x7ff, 0xf, 0x1, 0x0, 0x4], [0x80000001, 0x9, 0x4, 0x8, 0x8, 0x7, 0x6, 0x8000000000000000, 0x4, 0x80, 0x401, 0x4, 0x2, 0x0, 0x9, 0xfffffffffffffff8, 0x8, 0xffffffff, 0x800, 0xffffffffd22d03a3, 0x6, 0x8, 0x8, 0xfff, 0x8, 0x8000000000000001, 0x9, 0x6c667f02, 0x3f, 0x7, 0xfffffffffffffffb, 0xc1, 0x81, 0x0, 0x6, 0x0, 0x1fc, 0x2, 0x1, 0xc16, 0x5, 0x5, 0x7fffffffffffffff, 0x40, 0x7, 0x4, 0x1ff, 0x4, 0x1, 0x2, 0xfffffffffffffe01, 0xfffffffffffffffc, 0x0, 0x6, 0x8000000000000001, 0x81, 0x8000000000000001, 0x101, 0x8, 0x2, 0x3, 0xe55, 0xfffffffffffffffd, 0x5, 0x80, 0x9, 0xffff, 0x6, 0x8000000000000001, 0x2, 0x200, 0x7a1559a0, 0x3669, 0x7fff, 0x6, 0x2, 0x8001, 0x7, 0x8000000000000001, 0x9, 0xfffffffffffffffa, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x80000001, 0x0, 0x8, 0xfffffffeffffffff, 0x2, 0xe8a, 0xb53, 0x6, 0x8000000000, 0x5, 0x1f, 0x5, 0x1f, 0x8b0, 0x10001, 0x100000000, 0x0, 0x1, 0x6, 0x7, 0x6, 0x80000001, 0x6, 0x6, 0x5, 0x4118069f, 0x3, 0x81, 0x7ff, 0xfff, 0x4, 0x80000001, 0x100, 0x8, 0x1ff, 0xb4]}) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:52 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x220041) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 3: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x2010, 0xffffffffffffffff, 0x80000000) (async) sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200400c1}, 0x20044811) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000080), 0x200, 0x141002) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000000c0)=0x1, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r4 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r4, &(0x7f0000000180), &(0x7f00000001c0)=0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r3, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000080), 0x200, 0x141002) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000000c0)=0x1, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) socket$tipc(0x1e, 0x2, 0x0) (async) getpeername$tipc(r4, &(0x7f0000000180), &(0x7f00000001c0)=0x10) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r3, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x100000000000002, 0x0, 0x111, 0x9}}, 0x20) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000480)={0x0, 0x3, 0x0, [0x7ff, 0xf, 0x1, 0x0, 0x4], [0x80000001, 0x9, 0x4, 0x8, 0x8, 0x7, 0x6, 0x8000000000000000, 0x4, 0x80, 0x401, 0x4, 0x2, 0x0, 0x9, 0xfffffffffffffff8, 0x8, 0xffffffff, 0x800, 0xffffffffd22d03a3, 0x6, 0x8, 0x8, 0xfff, 0x8, 0x8000000000000001, 0x9, 0x6c667f02, 0x3f, 0x7, 0xfffffffffffffffb, 0xc1, 0x81, 0x0, 0x6, 0x0, 0x1fc, 0x2, 0x1, 0xc16, 0x5, 0x5, 0x7fffffffffffffff, 0x40, 0x7, 0x4, 0x1ff, 0x4, 0x1, 0x2, 0xfffffffffffffe01, 0xfffffffffffffffc, 0x0, 0x6, 0x8000000000000001, 0x81, 0x8000000000000001, 0x101, 0x8, 0x2, 0x3, 0xe55, 0xfffffffffffffffd, 0x5, 0x80, 0x9, 0xffff, 0x6, 0x8000000000000001, 0x2, 0x200, 0x7a1559a0, 0x3669, 0x7fff, 0x6, 0x2, 0x8001, 0x7, 0x8000000000000001, 0x9, 0xfffffffffffffffa, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x80000001, 0x0, 0x8, 0xfffffffeffffffff, 0x2, 0xe8a, 0xb53, 0x6, 0x8000000000, 0x5, 0x1f, 0x5, 0x1f, 0x8b0, 0x10001, 0x100000000, 0x0, 0x1, 0x6, 0x7, 0x6, 0x80000001, 0x6, 0x6, 0x5, 0x4118069f, 0x3, 0x81, 0x7ff, 0xfff, 0x4, 0x80000001, 0x100, 0x8, 0x1ff, 0xb4]}) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x100000000000002, 0x0, 0x111, 0x9}}, 0x20) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000480)={0x0, 0x3, 0x0, [0x7ff, 0xf, 0x1, 0x0, 0x4], [0x80000001, 0x9, 0x4, 0x8, 0x8, 0x7, 0x6, 0x8000000000000000, 0x4, 0x80, 0x401, 0x4, 0x2, 0x0, 0x9, 0xfffffffffffffff8, 0x8, 0xffffffff, 0x800, 0xffffffffd22d03a3, 0x6, 0x8, 0x8, 0xfff, 0x8, 0x8000000000000001, 0x9, 0x6c667f02, 0x3f, 0x7, 0xfffffffffffffffb, 0xc1, 0x81, 0x0, 0x6, 0x0, 0x1fc, 0x2, 0x1, 0xc16, 0x5, 0x5, 0x7fffffffffffffff, 0x40, 0x7, 0x4, 0x1ff, 0x4, 0x1, 0x2, 0xfffffffffffffe01, 0xfffffffffffffffc, 0x0, 0x6, 0x8000000000000001, 0x81, 0x8000000000000001, 0x101, 0x8, 0x2, 0x3, 0xe55, 0xfffffffffffffffd, 0x5, 0x80, 0x9, 0xffff, 0x6, 0x8000000000000001, 0x2, 0x200, 0x7a1559a0, 0x3669, 0x7fff, 0x6, 0x2, 0x8001, 0x7, 0x8000000000000001, 0x9, 0xfffffffffffffffa, 0xffffffffffffffff, 0x1, 0x4, 0x5, 0x80000001, 0x0, 0x8, 0xfffffffeffffffff, 0x2, 0xe8a, 0xb53, 0x6, 0x8000000000, 0x5, 0x1f, 0x5, 0x1f, 0x8b0, 0x10001, 0x100000000, 0x0, 0x1, 0x6, 0x7, 0x6, 0x80000001, 0x6, 0x6, 0x5, 0x4118069f, 0x3, 0x81, 0x7ff, 0xfff, 0x4, 0x80000001, 0x100, 0x8, 0x1ff, 0xb4]}) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) (async) 20:03:52 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x220041) 20:03:52 executing program 2: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x220041) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x220041) (async) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r3 = io_uring_setup(0x1, &(0x7f0000000340)={0x0, 0x1518, 0x8, 0x2, 0x4f}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r3, 0x84009422, &(0x7f0000000c00)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r4 = syz_io_uring_setup(0x3af3, &(0x7f0000000240)={0x0, 0xd975, 0x1, 0x3, 0x216, 0x0, r3}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) syz_io_uring_setup(0x65d9, &(0x7f0000000080)={0x0, 0x483c, 0x8, 0x10000000, 0x6d, 0x0, r4}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000180)) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f00000007c0)={0x0, 0x40, 0x0, [0xffffffffffffffff, 0x1, 0x0, 0x8000000005, 0x4], [0x3, 0xf9, 0x4, 0x81, 0x7fff, 0x2, 0x8, 0x1000, 0x97c, 0x0, 0x7ae2, 0x7, 0x200020000, 0xa52, 0x3, 0x10000, 0xfffffffffffffffc, 0x3ff, 0x603, 0x6, 0x9d14, 0x1000, 0x80000001, 0x0, 0x800, 0x7, 0x8, 0x8000, 0x1161, 0xffffffff7fffffff, 0x100000000, 0x4, 0x8001, 0x1, 0xffffffffffffffff, 0x8000, 0x8, 0x7ff, 0x80000001, 0x5, 0x7cde, 0x7, 0x7, 0x0, 0x1, 0x3, 0x725206bf, 0x5, 0x8, 0x1, 0x8000000000000000, 0x80, 0x5, 0x2a9, 0xab5a, 0xe73e, 0xbf, 0x4, 0x7fffffff, 0x40bf, 0xd65e, 0x0, 0x2, 0x1, 0x1000, 0xaa, 0x0, 0xfff, 0xe046, 0xffffffffffffa488, 0x3, 0x10001, 0x6, 0x7fffffffffffffff, 0x2, 0x438, 0x2b5, 0xfff, 0x1, 0x0, 0xffffffffffffff81, 0xc742, 0x8, 0xffffffffffffffff, 0x85f3, 0x1, 0x7, 0x1, 0x40, 0x2, 0x1, 0x40, 0x3, 0x40, 0x7, 0x8, 0xfffffffffffeffff, 0x20, 0xff, 0x4, 0xfffffffffffffffa, 0x4, 0x936, 0x0, 0x8000, 0x6, 0x6, 0xffffffffffffffff, 0x0, 0x7, 0x4, 0x0, 0x9, 0x3, 0x1, 0xac40, 0x8, 0x89, 0x7f, 0x40, 0xaf74]}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r6, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0xc) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000500)={0x16, 0x98, 0xfa00, {&(0x7f00000004c0), 0x1, r7, 0x1c, 0x1, @in6={0xa, 0x4e23, 0x1b08, @loopback, 0x6}}}, 0xa0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r5, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), 0xffffffffffffffff) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02002000", @ANYRES16=r8, @ANYBLOB="040025bd7000fe000800766c61643000000000000000000000000500040060bfd31a"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x4040080) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), 0xffffffffffffffff, r3}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x4380c2) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5002005a03cd73e4b7e4dc1eb7ced27dd98a7a31f046c8d9cd595e0464a2b7bd006317c8949a7fa1c88d17729a7b431138cea0c9dcd7003ab894ef6f01022fd3fb687bf2aaa395060331dbfa4261919d6038a50e01e31ebadea153689ce5c43e08e8ce79e066a929a2d3cc05b5c86971c67ec3202dbcfc432a8bfa52506d8e875802fe54c4b08bb90c68970ab3d441d432", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="080001002d3ad8b235fde9efbe9ac5118f0304091b42", @ANYRES32, @ANYBLOB='\b\x00O7', @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = accept4$tipc(r2, &(0x7f0000000140), &(0x7f0000000040)=0x10, 0xd122294d8d207f9) getsockopt$TIPC_NODE_RECVQ_DEPTH(r3, 0x10f, 0x83, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r4 = accept4$tipc(r0, &(0x7f0000000080)=@name, &(0x7f0000000200)=0x10, 0x100800) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) getsockname$tipc(r4, &(0x7f0000000240)=@name, &(0x7f0000000280)=0x10) 20:03:52 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), 0xffffffffffffffff, r3}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), 0xffffffffffffffff, r3}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) (async) 20:03:52 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) write$P9_RSYMLINK(r0, &(0x7f0000000140)={0x14, 0x11, 0x7fff, {0x2, 0x4, 0x2}}, 0x14) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f4020000", @ANYRES16=0x0, @ANYBLOB="01002abd7000fddbdf2503000000740008801400078008000500dd4c6e2308000500e45e0b250c000780080006009c0000002400078008000500cf78c67d08000500eceea10b080006008f0000000800050068c67a502c000780080006007d00000008000600f300000008000600ad00000008000500045de64208000600270000002c01088024000780080006003200000008000600ad00000008000500ecd360f9070005003ba31c6a140007800800050036ec495d08000600c70000001c00078008000600c000000008000600e800000008000600cf0000001c00078008000600d800000008000500d92cda34080006009e0000000c0007800800050085832a305400078008000600cd000000080005007ef02d3308000500e30a532f08000600dd0000000800050025ecf952080006003600000008000500f94d083d0800050003323163080005001f2b902508000600930000003400078008000500ed92a263080006007700000008000500ed53a8580800060038000000080005002f255e2e080006003800000024000780080005007a2e230408000600ab00000008000600230000000800060038000000280108801c000780080006004b000000080006009f00000008000500e53afd6f0c00078008000500c5cb4e2e340007800800050086d93a4e08000600a100000008000600b400000008000600d80000000800050030f1f56908000500922853530c000780080005000a299a3c24000780080006007d00000008000500a21090610800060040000000080006007700000044000780080005003eade33a0800060084000000080006000100000008000500c684fa4c080006001e00000008000600e000000008000600b100000008000500e452e14b1c000780080005004f582245080005003ee22a6008000600790000002c00078008000600810000000800050058fc9b7a08000600c100000008000600370000000800050061da52200c0007800800060099000000080002000300000008000200030000000800020002000000"], 0x2f4}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000000)={0x4, 0x1}) 20:03:52 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x4380c2) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5002005a03cd73e4b7e4dc1eb7ced27dd98a7a31f046c8d9cd595e0464a2b7bd006317c8949a7fa1c88d17729a7b431138cea0c9dcd7003ab894ef6f01022fd3fb687bf2aaa395060331dbfa4261919d6038a50e01e31ebadea153689ce5c43e08e8ce79e066a929a2d3cc05b5c86971c67ec3202dbcfc432a8bfa52506d8e875802fe54c4b08bb90c68970ab3d441d432", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="080001002d3ad8b235fde9efbe9ac5118f0304091b42", @ANYRES32, @ANYBLOB='\b\x00O7', @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) r3 = accept4$tipc(r2, &(0x7f0000000140), &(0x7f0000000040)=0x10, 0xd122294d8d207f9) getsockopt$TIPC_NODE_RECVQ_DEPTH(r3, 0x10f, 0x83, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) r4 = accept4$tipc(r0, &(0x7f0000000080)=@name, &(0x7f0000000200)=0x10, 0x100800) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async, rerun: 64) getsockname$tipc(r4, &(0x7f0000000240)=@name, &(0x7f0000000280)=0x10) (rerun: 64) 20:03:52 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r3 = io_uring_setup(0x1, &(0x7f0000000340)={0x0, 0x1518, 0x8, 0x2, 0x4f}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r3, 0x84009422, &(0x7f0000000c00)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r4 = syz_io_uring_setup(0x3af3, &(0x7f0000000240)={0x0, 0xd975, 0x1, 0x3, 0x216, 0x0, r3}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) syz_io_uring_setup(0x65d9, &(0x7f0000000080)={0x0, 0x483c, 0x8, 0x10000000, 0x6d, 0x0, r4}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000180)) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f00000007c0)={0x0, 0x40, 0x0, [0xffffffffffffffff, 0x1, 0x0, 0x8000000005, 0x4], [0x3, 0xf9, 0x4, 0x81, 0x7fff, 0x2, 0x8, 0x1000, 0x97c, 0x0, 0x7ae2, 0x7, 0x200020000, 0xa52, 0x3, 0x10000, 0xfffffffffffffffc, 0x3ff, 0x603, 0x6, 0x9d14, 0x1000, 0x80000001, 0x0, 0x800, 0x7, 0x8, 0x8000, 0x1161, 0xffffffff7fffffff, 0x100000000, 0x4, 0x8001, 0x1, 0xffffffffffffffff, 0x8000, 0x8, 0x7ff, 0x80000001, 0x5, 0x7cde, 0x7, 0x7, 0x0, 0x1, 0x3, 0x725206bf, 0x5, 0x8, 0x1, 0x8000000000000000, 0x80, 0x5, 0x2a9, 0xab5a, 0xe73e, 0xbf, 0x4, 0x7fffffff, 0x40bf, 0xd65e, 0x0, 0x2, 0x1, 0x1000, 0xaa, 0x0, 0xfff, 0xe046, 0xffffffffffffa488, 0x3, 0x10001, 0x6, 0x7fffffffffffffff, 0x2, 0x438, 0x2b5, 0xfff, 0x1, 0x0, 0xffffffffffffff81, 0xc742, 0x8, 0xffffffffffffffff, 0x85f3, 0x1, 0x7, 0x1, 0x40, 0x2, 0x1, 0x40, 0x3, 0x40, 0x7, 0x8, 0xfffffffffffeffff, 0x20, 0xff, 0x4, 0xfffffffffffffffa, 0x4, 0x936, 0x0, 0x8000, 0x6, 0x6, 0xffffffffffffffff, 0x0, 0x7, 0x4, 0x0, 0x9, 0x3, 0x1, 0xac40, 0x8, 0x89, 0x7f, 0x40, 0xaf74]}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r6, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0xc) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000500)={0x16, 0x98, 0xfa00, {&(0x7f00000004c0), 0x1, r7, 0x1c, 0x1, @in6={0xa, 0x4e23, 0x1b08, @loopback, 0x6}}}, 0xa0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r5, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), 0xffffffffffffffff) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02002000", @ANYRES16=r8, @ANYBLOB="040025bd7000fe000800766c61643000000000000000000000000500040060bfd31a"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x4040080) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) io_uring_setup(0x1, &(0x7f0000000340)={0x0, 0x1518, 0x8, 0x2, 0x4f}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r3, 0x84009422, &(0x7f0000000c00)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) syz_io_uring_setup(0x3af3, &(0x7f0000000240)={0x0, 0xd975, 0x1, 0x3, 0x216, 0x0, r3}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) (async) syz_io_uring_setup(0x65d9, &(0x7f0000000080)={0x0, 0x483c, 0x8, 0x10000000, 0x6d, 0x0, r4}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000180)) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f00000007c0)={0x0, 0x40, 0x0, [0xffffffffffffffff, 0x1, 0x0, 0x8000000005, 0x4], [0x3, 0xf9, 0x4, 0x81, 0x7fff, 0x2, 0x8, 0x1000, 0x97c, 0x0, 0x7ae2, 0x7, 0x200020000, 0xa52, 0x3, 0x10000, 0xfffffffffffffffc, 0x3ff, 0x603, 0x6, 0x9d14, 0x1000, 0x80000001, 0x0, 0x800, 0x7, 0x8, 0x8000, 0x1161, 0xffffffff7fffffff, 0x100000000, 0x4, 0x8001, 0x1, 0xffffffffffffffff, 0x8000, 0x8, 0x7ff, 0x80000001, 0x5, 0x7cde, 0x7, 0x7, 0x0, 0x1, 0x3, 0x725206bf, 0x5, 0x8, 0x1, 0x8000000000000000, 0x80, 0x5, 0x2a9, 0xab5a, 0xe73e, 0xbf, 0x4, 0x7fffffff, 0x40bf, 0xd65e, 0x0, 0x2, 0x1, 0x1000, 0xaa, 0x0, 0xfff, 0xe046, 0xffffffffffffa488, 0x3, 0x10001, 0x6, 0x7fffffffffffffff, 0x2, 0x438, 0x2b5, 0xfff, 0x1, 0x0, 0xffffffffffffff81, 0xc742, 0x8, 0xffffffffffffffff, 0x85f3, 0x1, 0x7, 0x1, 0x40, 0x2, 0x1, 0x40, 0x3, 0x40, 0x7, 0x8, 0xfffffffffffeffff, 0x20, 0xff, 0x4, 0xfffffffffffffffa, 0x4, 0x936, 0x0, 0x8000, 0x6, 0x6, 0xffffffffffffffff, 0x0, 0x7, 0x4, 0x0, 0x9, 0x3, 0x1, 0xac40, 0x8, 0x89, 0x7f, 0x40, 0xaf74]}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r6, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0xc) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000500)={0x16, 0x98, 0xfa00, {&(0x7f00000004c0), 0x1, r7, 0x1c, 0x1, @in6={0xa, 0x4e23, 0x1b08, @loopback, 0x6}}}, 0xa0) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r5, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), 0xffffffffffffffff) (async) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02002000", @ANYRES16=r8, @ANYBLOB="040025bd7000fe000800766c61643000000000000000000000000500040060bfd31a"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x4040080) (async) 20:03:52 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) write$P9_RSYMLINK(r0, &(0x7f0000000140)={0x14, 0x11, 0x7fff, {0x2, 0x4, 0x2}}, 0x14) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f4020000", @ANYRES16=0x0, @ANYBLOB="01002abd7000fddbdf2503000000740008801400078008000500dd4c6e2308000500e45e0b250c000780080006009c0000002400078008000500cf78c67d08000500eceea10b080006008f0000000800050068c67a502c000780080006007d00000008000600f300000008000600ad00000008000500045de64208000600270000002c01088024000780080006003200000008000600ad00000008000500ecd360f9070005003ba31c6a140007800800050036ec495d08000600c70000001c00078008000600c000000008000600e800000008000600cf0000001c00078008000600d800000008000500d92cda34080006009e0000000c0007800800050085832a305400078008000600cd000000080005007ef02d3308000500e30a532f08000600dd0000000800050025ecf952080006003600000008000500f94d083d0800050003323163080005001f2b902508000600930000003400078008000500ed92a263080006007700000008000500ed53a8580800060038000000080005002f255e2e080006003800000024000780080005007a2e230408000600ab00000008000600230000000800060038000000280108801c000780080006004b000000080006009f00000008000500e53afd6f0c00078008000500c5cb4e2e340007800800050086d93a4e08000600a100000008000600b400000008000600d80000000800050030f1f56908000500922853530c000780080005000a299a3c24000780080006007d00000008000500a21090610800060040000000080006007700000044000780080005003eade33a0800060084000000080006000100000008000500c684fa4c080006001e00000008000600e000000008000600b100000008000500e452e14b1c000780080005004f582245080005003ee22a6008000600790000002c00078008000600810000000800050058fc9b7a08000600c100000008000600370000000800050061da52200c0007800800060099000000080002000300000008000200030000000800020002000000"], 0x2f4}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000000)={0x4, 0x1}) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) write$P9_RSYMLINK(r0, &(0x7f0000000140)={0x14, 0x11, 0x7fff, {0x2, 0x4, 0x2}}, 0x14) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f4020000", @ANYRES16=0x0, @ANYBLOB="01002abd7000fddbdf2503000000740008801400078008000500dd4c6e2308000500e45e0b250c000780080006009c0000002400078008000500cf78c67d08000500eceea10b080006008f0000000800050068c67a502c000780080006007d00000008000600f300000008000600ad00000008000500045de64208000600270000002c01088024000780080006003200000008000600ad00000008000500ecd360f9070005003ba31c6a140007800800050036ec495d08000600c70000001c00078008000600c000000008000600e800000008000600cf0000001c00078008000600d800000008000500d92cda34080006009e0000000c0007800800050085832a305400078008000600cd000000080005007ef02d3308000500e30a532f08000600dd0000000800050025ecf952080006003600000008000500f94d083d0800050003323163080005001f2b902508000600930000003400078008000500ed92a263080006007700000008000500ed53a8580800060038000000080005002f255e2e080006003800000024000780080005007a2e230408000600ab00000008000600230000000800060038000000280108801c000780080006004b000000080006009f00000008000500e53afd6f0c00078008000500c5cb4e2e340007800800050086d93a4e08000600a100000008000600b400000008000600d80000000800050030f1f56908000500922853530c000780080005000a299a3c24000780080006007d00000008000500a21090610800060040000000080006007700000044000780080005003eade33a0800060084000000080006000100000008000500c684fa4c080006001e00000008000600e000000008000600b100000008000500e452e14b1c000780080005004f582245080005003ee22a6008000600790000002c00078008000600810000000800050058fc9b7a08000600c100000008000600370000000800050061da52200c0007800800060099000000080002000300000008000200030000000800020002000000"], 0x2f4}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) (async) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000000)={0x4, 0x1}) (async) 20:03:52 executing program 5: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x4380c2) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5002005a03cd73e4b7e4dc1eb7ced27dd98a7a31f046c8d9cd595e0464a2b7bd006317c8949a7fa1c88d17729a7b431138cea0c9dcd7003ab894ef6f01022fd3fb687bf2aaa395060331dbfa4261919d6038a50e01e31ebadea153689ce5c43e08e8ce79e066a929a2d3cc05b5c86971c67ec3202dbcfc432a8bfa52506d8e875802fe54c4b08bb90c68970ab3d441d432", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="080001002d3ad8b235fde9efbe9ac5118f0304091b42", @ANYRES32, @ANYBLOB='\b\x00O7', @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = accept4$tipc(r2, &(0x7f0000000140), &(0x7f0000000040)=0x10, 0xd122294d8d207f9) getsockopt$TIPC_NODE_RECVQ_DEPTH(r3, 0x10f, 0x83, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r4 = accept4$tipc(r0, &(0x7f0000000080)=@name, &(0x7f0000000200)=0x10, 0x100800) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) getsockname$tipc(r4, &(0x7f0000000240)=@name, &(0x7f0000000280)=0x10) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x4380c2) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5002005a03cd73e4b7e4dc1eb7ced27dd98a7a31f046c8d9cd595e0464a2b7bd006317c8949a7fa1c88d17729a7b431138cea0c9dcd7003ab894ef6f01022fd3fb687bf2aaa395060331dbfa4261919d6038a50e01e31ebadea153689ce5c43e08e8ce79e066a929a2d3cc05b5c86971c67ec3202dbcfc432a8bfa52506d8e875802fe54c4b08bb90c68970ab3d441d432", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="080001002d3ad8b235fde9efbe9ac5118f0304091b42", @ANYRES32, @ANYBLOB='\b\x00O7', @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) accept4$tipc(r2, &(0x7f0000000140), &(0x7f0000000040)=0x10, 0xd122294d8d207f9) (async) getsockopt$TIPC_NODE_RECVQ_DEPTH(r3, 0x10f, 0x83, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) accept4$tipc(r0, &(0x7f0000000080)=@name, &(0x7f0000000200)=0x10, 0x100800) (async) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) getsockname$tipc(r4, &(0x7f0000000240)=@name, &(0x7f0000000280)=0x10) (async) 20:03:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), 0xffffffffffffffff, r3}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) r3 = io_uring_setup(0x1, &(0x7f0000000340)={0x0, 0x1518, 0x8, 0x2, 0x4f}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r3, 0x84009422, &(0x7f0000000c00)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r4 = syz_io_uring_setup(0x3af3, &(0x7f0000000240)={0x0, 0xd975, 0x1, 0x3, 0x216, 0x0, r3}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) syz_io_uring_setup(0x65d9, &(0x7f0000000080)={0x0, 0x483c, 0x8, 0x10000000, 0x6d, 0x0, r4}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000180)) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f00000007c0)={0x0, 0x40, 0x0, [0xffffffffffffffff, 0x1, 0x0, 0x8000000005, 0x4], [0x3, 0xf9, 0x4, 0x81, 0x7fff, 0x2, 0x8, 0x1000, 0x97c, 0x0, 0x7ae2, 0x7, 0x200020000, 0xa52, 0x3, 0x10000, 0xfffffffffffffffc, 0x3ff, 0x603, 0x6, 0x9d14, 0x1000, 0x80000001, 0x0, 0x800, 0x7, 0x8, 0x8000, 0x1161, 0xffffffff7fffffff, 0x100000000, 0x4, 0x8001, 0x1, 0xffffffffffffffff, 0x8000, 0x8, 0x7ff, 0x80000001, 0x5, 0x7cde, 0x7, 0x7, 0x0, 0x1, 0x3, 0x725206bf, 0x5, 0x8, 0x1, 0x8000000000000000, 0x80, 0x5, 0x2a9, 0xab5a, 0xe73e, 0xbf, 0x4, 0x7fffffff, 0x40bf, 0xd65e, 0x0, 0x2, 0x1, 0x1000, 0xaa, 0x0, 0xfff, 0xe046, 0xffffffffffffa488, 0x3, 0x10001, 0x6, 0x7fffffffffffffff, 0x2, 0x438, 0x2b5, 0xfff, 0x1, 0x0, 0xffffffffffffff81, 0xc742, 0x8, 0xffffffffffffffff, 0x85f3, 0x1, 0x7, 0x1, 0x40, 0x2, 0x1, 0x40, 0x3, 0x40, 0x7, 0x8, 0xfffffffffffeffff, 0x20, 0xff, 0x4, 0xfffffffffffffffa, 0x4, 0x936, 0x0, 0x8000, 0x6, 0x6, 0xffffffffffffffff, 0x0, 0x7, 0x4, 0x0, 0x9, 0x3, 0x1, 0xac40, 0x8, 0x89, 0x7f, 0x40, 0xaf74]}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r6, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0xc) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000500)={0x16, 0x98, 0xfa00, {&(0x7f00000004c0), 0x1, r7, 0x1c, 0x1, @in6={0xa, 0x4e23, 0x1b08, @loopback, 0x6}}}, 0xa0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r5, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), 0xffffffffffffffff) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02002000", @ANYRES16=r8, @ANYBLOB="040025bd7000fe000800766c61643000000000000000000000000500040060bfd31a"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x4040080) 20:03:52 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) write$P9_RSYMLINK(r0, &(0x7f0000000140)={0x14, 0x11, 0x7fff, {0x2, 0x4, 0x2}}, 0x14) (rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f4020000", @ANYRES16=0x0, @ANYBLOB="01002abd7000fddbdf2503000000740008801400078008000500dd4c6e2308000500e45e0b250c000780080006009c0000002400078008000500cf78c67d08000500eceea10b080006008f0000000800050068c67a502c000780080006007d00000008000600f300000008000600ad00000008000500045de64208000600270000002c01088024000780080006003200000008000600ad00000008000500ecd360f9070005003ba31c6a140007800800050036ec495d08000600c70000001c00078008000600c000000008000600e800000008000600cf0000001c00078008000600d800000008000500d92cda34080006009e0000000c0007800800050085832a305400078008000600cd000000080005007ef02d3308000500e30a532f08000600dd0000000800050025ecf952080006003600000008000500f94d083d0800050003323163080005001f2b902508000600930000003400078008000500ed92a263080006007700000008000500ed53a8580800060038000000080005002f255e2e080006003800000024000780080005007a2e230408000600ab00000008000600230000000800060038000000280108801c000780080006004b000000080006009f00000008000500e53afd6f0c00078008000500c5cb4e2e340007800800050086d93a4e08000600a100000008000600b400000008000600d80000000800050030f1f56908000500922853530c000780080005000a299a3c24000780080006007d00000008000500a21090610800060040000000080006007700000044000780080005003eade33a0800060084000000080006000100000008000500c684fa4c080006001e00000008000600e000000008000600b100000008000500e452e14b1c000780080005004f582245080005003ee22a6008000600790000002c00078008000600810000000800050058fc9b7a08000600c100000008000600370000000800050061da52200c0007800800060099000000080002000300000008000200030000000800020002000000"], 0x2f4}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) (async, rerun: 64) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000000)={0x4, 0x1}) 20:03:52 executing program 5: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0x7fff, 0x8040) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xffff}}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2000020, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000080), 0xa652, 0x101) io_uring_register$IORING_UNREGISTER_EVENTFD(r3, 0x5, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:52 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:52 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xffff}}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2000020, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000080), 0xa652, 0x101) io_uring_register$IORING_UNREGISTER_EVENTFD(r3, 0x5, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xffff}}, 0x10) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2000020, &(0x7f0000000140), 0x13f, 0x5}}, 0x20) (async) syz_open_dev$vcsn(&(0x7f0000000080), 0xa652, 0x101) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r3, 0x5, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) 20:03:52 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0x7fff, 0x8040) syz_open_dev$vcsn(&(0x7f0000000000), 0x7fff, 0x8040) (async) 20:03:52 executing program 5: openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:52 executing program 3: setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x2, {{0x42, 0x4}, 0x73ff}}, 0x10, &(0x7f0000000240)=[{&(0x7f00000000c0)="3521beee31fae08e76384955348212dda10f977681a58e74ec1227e49190664cdc7b8dcfdf375699bc125357ea8e8f64a96a409b145675d9fbfba4c3da7cf3a8152741ad4dec90059aa128bf0afc154879e226b001b4e2180476b467a36299e9138e5fa68382ff2249542a81a2bea0f2", 0x70}, {&(0x7f0000000140)="789ac6408087b18d8f6755d2ea759bbde170de4a68bf31326749d800330ba30a5581940123d92953", 0x28}, {&(0x7f0000000180)="a17d08ab5dec6ac45d1459fc3f0a3e44106cc2c419b6f3f06d8f85e080f5ebd1b9b3ba921f0d030dbea10dc6479a249efa748ea8abda1895380ebd8126ee13eb336dd2973485885a4771e2fbc7e9f1a8d8b74becf2989c2b912ec6fb0e83ed428ea34255a0fc38d47cf7442c153ec2dffc6f262403b136b38d542ce80bc482c67c062a441209c9760f4056e03f26ef4fb60e04f574d6e49532af3b", 0x9b}], 0x3, 0x0, 0x0, 0x40}, 0x4880) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffff1460, 0xc042) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800fda4", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x4000010, r1, 0x100000000) socket$inet_udp(0x2, 0x2, 0x0) 20:03:52 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0x7fff, 0x8040) syz_open_dev$vcsn(&(0x7f0000000000), 0x7fff, 0x8040) (async) 20:03:52 executing program 3: setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000040), 0x4) (async) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x2, {{0x42, 0x4}, 0x73ff}}, 0x10, &(0x7f0000000240)=[{&(0x7f00000000c0)="3521beee31fae08e76384955348212dda10f977681a58e74ec1227e49190664cdc7b8dcfdf375699bc125357ea8e8f64a96a409b145675d9fbfba4c3da7cf3a8152741ad4dec90059aa128bf0afc154879e226b001b4e2180476b467a36299e9138e5fa68382ff2249542a81a2bea0f2", 0x70}, {&(0x7f0000000140)="789ac6408087b18d8f6755d2ea759bbde170de4a68bf31326749d800330ba30a5581940123d92953", 0x28}, {&(0x7f0000000180)="a17d08ab5dec6ac45d1459fc3f0a3e44106cc2c419b6f3f06d8f85e080f5ebd1b9b3ba921f0d030dbea10dc6479a249efa748ea8abda1895380ebd8126ee13eb336dd2973485885a4771e2fbc7e9f1a8d8b74becf2989c2b912ec6fb0e83ed428ea34255a0fc38d47cf7442c153ec2dffc6f262403b136b38d542ce80bc482c67c062a441209c9760f4056e03f26ef4fb60e04f574d6e49532af3b", 0x9b}], 0x3, 0x0, 0x0, 0x40}, 0x4880) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffff1460, 0xc042) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800fda4", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x4000010, r1, 0x100000000) socket$inet_udp(0x2, 0x2, 0x0) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xffff}}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2000020, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000080), 0xa652, 0x101) io_uring_register$IORING_UNREGISTER_EVENTFD(r3, 0x5, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xffff}}, 0x10) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2000020, &(0x7f0000000140), 0x13f, 0x5}}, 0x20) (async) syz_open_dev$vcsn(&(0x7f0000000080), 0xa652, 0x101) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r3, 0x5, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x4) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x1, 0x4) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x10, r3, 0x4) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r4, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x0, {0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x80}, r2}}, 0x38) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000140)={0x54, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f00000001c0), &(0x7f0000000200)=0x4) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000040)='/dev/vcs#\x00', &(0x7f0000000080)="1d8b6cd5104a14ef70ef2eb4775644c681180ffe5cfa03ea1c2ce17e9b0773c52c71f4e4f19dd9ad2075bf47c0b17abab9dfe8c11631e111ee1b6ce4350a798901399a307c7166949ec612eb7702027e1efbe2b8472cf5cfd9ff3dfbfc49304001f86d1e8ba5e80a0525da9ba1bdaf1ea5e233fcea27e3ab41a23e80312eff5946b46f996fba20fa59be03fbb9b1d9b39e58d36105bd6f", 0x97) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x0) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 3: setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x2, {{0x42, 0x4}, 0x73ff}}, 0x10, &(0x7f0000000240)=[{&(0x7f00000000c0)="3521beee31fae08e76384955348212dda10f977681a58e74ec1227e49190664cdc7b8dcfdf375699bc125357ea8e8f64a96a409b145675d9fbfba4c3da7cf3a8152741ad4dec90059aa128bf0afc154879e226b001b4e2180476b467a36299e9138e5fa68382ff2249542a81a2bea0f2", 0x70}, {&(0x7f0000000140)="789ac6408087b18d8f6755d2ea759bbde170de4a68bf31326749d800330ba30a5581940123d92953", 0x28}, {&(0x7f0000000180)="a17d08ab5dec6ac45d1459fc3f0a3e44106cc2c419b6f3f06d8f85e080f5ebd1b9b3ba921f0d030dbea10dc6479a249efa748ea8abda1895380ebd8126ee13eb336dd2973485885a4771e2fbc7e9f1a8d8b74becf2989c2b912ec6fb0e83ed428ea34255a0fc38d47cf7442c153ec2dffc6f262403b136b38d542ce80bc482c67c062a441209c9760f4056e03f26ef4fb60e04f574d6e49532af3b", 0x9b}], 0x3, 0x0, 0x0, 0x40}, 0x4880) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffff1460, 0xc042) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800fda4", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x4000010, r1, 0x100000000) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000040), 0x4) (async) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x2, {{0x42, 0x4}, 0x73ff}}, 0x10, &(0x7f0000000240)=[{&(0x7f00000000c0)="3521beee31fae08e76384955348212dda10f977681a58e74ec1227e49190664cdc7b8dcfdf375699bc125357ea8e8f64a96a409b145675d9fbfba4c3da7cf3a8152741ad4dec90059aa128bf0afc154879e226b001b4e2180476b467a36299e9138e5fa68382ff2249542a81a2bea0f2", 0x70}, {&(0x7f0000000140)="789ac6408087b18d8f6755d2ea759bbde170de4a68bf31326749d800330ba30a5581940123d92953", 0x28}, {&(0x7f0000000180)="a17d08ab5dec6ac45d1459fc3f0a3e44106cc2c419b6f3f06d8f85e080f5ebd1b9b3ba921f0d030dbea10dc6479a249efa748ea8abda1895380ebd8126ee13eb336dd2973485885a4771e2fbc7e9f1a8d8b74becf2989c2b912ec6fb0e83ed428ea34255a0fc38d47cf7442c153ec2dffc6f262403b136b38d542ce80bc482c67c062a441209c9760f4056e03f26ef4fb60e04f574d6e49532af3b", 0x9b}], 0x3, 0x0, 0x0, 0x40}, 0x4880) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffff1460, 0xc042) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800fda4", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$xdp(0x2c, 0x3, 0x0) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x4000010, r1, 0x100000000) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) 20:03:53 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x4) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) (async) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async, rerun: 64) r3 = fsmount(0xffffffffffffffff, 0x1, 0x4) (rerun: 64) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x10, r3, 0x4) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r4, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x0, {0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x80}, r2}}, 0x38) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000140)={0x54, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async, rerun: 32) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000040)='/dev/vcs#\x00', &(0x7f0000000080)="1d8b6cd5104a14ef70ef2eb4775644c681180ffe5cfa03ea1c2ce17e9b0773c52c71f4e4f19dd9ad2075bf47c0b17abab9dfe8c11631e111ee1b6ce4350a798901399a307c7166949ec612eb7702027e1efbe2b8472cf5cfd9ff3dfbfc49304001f86d1e8ba5e80a0525da9ba1bdaf1ea5e233fcea27e3ab41a23e80312eff5946b46f996fba20fa59be03fbb9b1d9b39e58d36105bd6f", 0x97) (rerun: 32) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x0) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x80000000) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x1, 0x4) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x10, r3, 0x4) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r4, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x0, {0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x80}, r2}}, 0x38) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = fsmount(0xffffffffffffffff, 0x0, 0x8) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r2, r4}}, 0x18) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000140)={0x54, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r2 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000040)='/dev/vcs#\x00', &(0x7f0000000080)="1d8b6cd5104a14ef70ef2eb4775644c681180ffe5cfa03ea1c2ce17e9b0773c52c71f4e4f19dd9ad2075bf47c0b17abab9dfe8c11631e111ee1b6ce4350a798901399a307c7166949ec612eb7702027e1efbe2b8472cf5cfd9ff3dfbfc49304001f86d1e8ba5e80a0525da9ba1bdaf1ea5e233fcea27e3ab41a23e80312eff5946b46f996fba20fa59be03fbb9b1d9b39e58d36105bd6f", 0x97) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x0) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = fsmount(0xffffffffffffffff, 0x0, 0x8) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r2, r4}}, 0x18) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000180)={0xffffffffffffffff}, 0x2, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xffffffff, @mcast2}, {0xa, 0x4e21, 0x7fff, @empty, 0x1e90}, r3, 0x5}}, 0x48) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0x5}}, 0x18) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x80000000) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x80000000) (async) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = fsmount(0xffffffffffffffff, 0x0, 0x8) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r2, r4}}, 0x18) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000180)={0xffffffffffffffff}, 0x2, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xffffffff, @mcast2}, {0xa, 0x4e21, 0x7fff, @empty, 0x1e90}, r3, 0x5}}, 0x48) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0x5}}, 0x18) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:53 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800010000002a8609fcf5b634472f1d08fb3296"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f00000000c0), 0x1, r3, 0x1c, 0x0, @in={0x2, 0x4e24, @broadcast}}}, 0xa0) mq_getsetattr(r0, &(0x7f0000000040)={0x6, 0x101, 0x0, 0x1ff}, &(0x7f0000000080)) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x80000000) 20:03:53 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800010000002a8609fcf5b634472f1d08fb3296"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f00000000c0), 0x1, r3, 0x1c, 0x0, @in={0x2, 0x4e24, @broadcast}}}, 0xa0) (async) mq_getsetattr(r0, &(0x7f0000000040)={0x6, 0x101, 0x0, 0x1ff}, &(0x7f0000000080)) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000004, 0x2131, 0xffffffffffffffff, 0x0) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000180)={0xffffffffffffffff}, 0x2, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xffffffff, @mcast2}, {0xa, 0x4e21, 0x7fff, @empty, 0x1e90}, r3, 0x5}}, 0x48) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0x5}}, 0x18) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:53 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800010000002a8609fcf5b634472f1d08fb3296"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f00000000c0), 0x1, r3, 0x1c, 0x0, @in={0x2, 0x4e24, @broadcast}}}, 0xa0) mq_getsetattr(r0, &(0x7f0000000040)={0x6, 0x101, 0x0, 0x1ff}, &(0x7f0000000080)) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000004, 0x2131, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000004, 0x2131, 0xffffffffffffffff, 0x0) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="080001007b3d5f53d9e34ffc69ce24830fe2bcce13408b198dc427943d601b32ffbc4f40c2d4844ba502d3f0162474d774f387b92a914bc376c0d749f65800c4f85ba4e1e6d3f25d6b206149867399fc3977c570aa09c5d18e6f4cbf87ab0dc45271f4a9ed9840472b0cf176864cb2248dfa496868dea6b461571f73deea72737a65bdc64974cd8cb2adfee0edc02174b72fe455ac694f2d62401690bca811d76e7cb2570a6ba57a58aab08e62c577371f37fb7885a28eea65237f387de9cddd94039083", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x1, @empty, 0xffffffff}, {0xa, 0x4e20, 0x5, @loopback, 0x10000}, r2, 0x81}}, 0x48) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0xffffffffffffffff, {0x10000, 0x2, "cf67848bd8a79c00b79df438ba32725640fc81ee0953a43c9509f7dc40adfe0c7dfccab16276ecb808286257bfc0dbb6cad814728947e746c22e6be4d89c62b18c7cb7722a77270c83733f57d9a6914f6e763ca8a983bebb9f5a132847d31b054eaf5dea9f8a37c1189a88bf073c768bf731cea1684ddea824dd5b279cfe08721a6d787df3595ab24882706da237c4dd89a4f00929ccffccb5563350a8403ac20329065c5e4a91587418342206b141c3504f5b98d711d5d05ad964780ef5cda744e921ed797d327702106d9abcebaa62bf705d577a4f9989b276f27f34a4b93076b98416f733dc7f74e7f494ed20afdbe637fc2bad9ed48e00570aa47f226757", 0x6, 0xe8, 0x7f, 0x5, 0xee, 0x8, 0x8}}}, 0x128) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xabd}, r5}}, 0x30) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:53 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) openat$cgroup_int(r0, &(0x7f0000000040)='cgroup.clone_children\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x0, @empty, 0x1}}}, 0x90) getsockname$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000004, 0x2131, 0xffffffffffffffff, 0x0) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="080001007b3d5f53d9e34ffc69ce24830fe2bcce13408b198dc427943d601b32ffbc4f40c2d4844ba502d3f0162474d774f387b92a914bc376c0d749f65800c4f85ba4e1e6d3f25d6b206149867399fc3977c570aa09c5d18e6f4cbf87ab0dc45271f4a9ed9840472b0cf176864cb2248dfa496868dea6b461571f73deea72737a65bdc64974cd8cb2adfee0edc02174b72fe455ac694f2d62401690bca811d76e7cb2570a6ba57a58aab08e62c577371f37fb7885a28eea65237f387de9cddd94039083", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x1, @empty, 0xffffffff}, {0xa, 0x4e20, 0x5, @loopback, 0x10000}, r2, 0x81}}, 0x48) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0xffffffffffffffff, {0x10000, 0x2, "cf67848bd8a79c00b79df438ba32725640fc81ee0953a43c9509f7dc40adfe0c7dfccab16276ecb808286257bfc0dbb6cad814728947e746c22e6be4d89c62b18c7cb7722a77270c83733f57d9a6914f6e763ca8a983bebb9f5a132847d31b054eaf5dea9f8a37c1189a88bf073c768bf731cea1684ddea824dd5b279cfe08721a6d787df3595ab24882706da237c4dd89a4f00929ccffccb5563350a8403ac20329065c5e4a91587418342206b141c3504f5b98d711d5d05ad964780ef5cda744e921ed797d327702106d9abcebaa62bf705d577a4f9989b276f27f34a4b93076b98416f733dc7f74e7f494ed20afdbe637fc2bad9ed48e00570aa47f226757", 0x6, 0xe8, 0x7f, 0x5, 0xee, 0x8, 0x8}}}, 0x128) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xabd}, r5}}, 0x30) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:53 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) openat$cgroup_int(r0, &(0x7f0000000040)='cgroup.clone_children\x00', 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x0, @empty, 0x1}}}, 0x90) getsockname$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 3: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x1, 0xfffffffffffffffa}, 0xf) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x600000b, 0x22113, 0xffffffffffffffff, 0x100000000) shmget(0x0, 0x2000, 0x4, &(0x7f0000ffe000/0x2000)=nil) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) (async, rerun: 64) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="080001007b3d5f53d9e34ffc69ce24830fe2bcce13408b198dc427943d601b32ffbc4f40c2d4844ba502d3f0162474d774f387b92a914bc376c0d749f65800c4f85ba4e1e6d3f25d6b206149867399fc3977c570aa09c5d18e6f4cbf87ab0dc45271f4a9ed9840472b0cf176864cb2248dfa496868dea6b461571f73deea72737a65bdc64974cd8cb2adfee0edc02174b72fe455ac694f2d62401690bca811d76e7cb2570a6ba57a58aab08e62c577371f37fb7885a28eea65237f387de9cddd94039083", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x1, @empty, 0xffffffff}, {0xa, 0x4e20, 0x5, @loopback, 0x10000}, r2, 0x81}}, 0x48) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0xffffffffffffffff, {0x10000, 0x2, "cf67848bd8a79c00b79df438ba32725640fc81ee0953a43c9509f7dc40adfe0c7dfccab16276ecb808286257bfc0dbb6cad814728947e746c22e6be4d89c62b18c7cb7722a77270c83733f57d9a6914f6e763ca8a983bebb9f5a132847d31b054eaf5dea9f8a37c1189a88bf073c768bf731cea1684ddea824dd5b279cfe08721a6d787df3595ab24882706da237c4dd89a4f00929ccffccb5563350a8403ac20329065c5e4a91587418342206b141c3504f5b98d711d5d05ad964780ef5cda744e921ed797d327702106d9abcebaa62bf705d577a4f9989b276f27f34a4b93076b98416f733dc7f74e7f494ed20afdbe637fc2bad9ed48e00570aa47f226757", 0x6, 0xe8, 0x7f, 0x5, 0xee, 0x8, 0x8}}}, 0x128) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r2, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) (rerun: 64) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xabd}, r5}}, 0x30) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1, 0x0, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f00000001c0)=0x40, r4, 0x0, 0x0, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r0, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r2, 0x4e07}}, 0x10) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) openat$cgroup_int(r6, &(0x7f0000000100)='rdma.max\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r7}}, 0x18) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) (rerun: 64) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f00000001c0)=0x40, r4, 0x0, 0x0, 0x1}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r0, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r2, 0x4e07}}, 0x10) (rerun: 64) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) openat$cgroup_int(r6, &(0x7f0000000100)='rdma.max\x00', 0x2, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r7}}, 0x18) 20:03:53 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) openat$cgroup_int(r0, &(0x7f0000000040)='cgroup.clone_children\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x0, @empty, 0x1}}}, 0x90) getsockname$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) openat$cgroup_int(r0, &(0x7f0000000040)='cgroup.clone_children\x00', 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080), 0x111, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x0, @empty, 0x1}}}, 0x90) (async) getsockname$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x1, 0xfffffffffffffffa}, 0xf) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x600000b, 0x22113, 0xffffffffffffffff, 0x100000000) (async, rerun: 64) shmget(0x0, 0x2000, 0x4, &(0x7f0000ffe000/0x2000)=nil) (rerun: 64) 20:03:53 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 3: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x1, 0xfffffffffffffffa}, 0xf) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x600000b, 0x22113, 0xffffffffffffffff, 0x100000000) shmget(0x0, 0x2000, 0x4, &(0x7f0000ffe000/0x2000)=nil) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x1, 0xfffffffffffffffa}, 0xf) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x600000b, 0x22113, 0xffffffffffffffff, 0x100000000) (async) shmget(0x0, 0x2000, 0x4, &(0x7f0000ffe000/0x2000)=nil) (async) 20:03:53 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 32) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f00000001c0)=0x40, r4, 0x0, 0x0, 0x1}}, 0x20) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r0, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r2, 0x4e07}}, 0x10) (async) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) openat$cgroup_int(r6, &(0x7f0000000100)='rdma.max\x00', 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r7}}, 0x18) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000000)=[{0x22, 0x0, [0x4, 0x80000001, 0x7f, 0x408, 0x400, 0x84, 0x1, 0x100, 0x10000, 0xfff, 0xfff, 0xff, 0x9, 0x92, 0xa8, 0x8]}, {0x10, 0x0, [0x7, 0x99, 0x40, 0x7, 0xc4, 0x8000, 0x3, 0x2, 0xfffffffc, 0x50b9a1da, 0x7fffffff, 0x8, 0xffff, 0x5, 0x0, 0x8]}], r1, 0x1, 0x1, 0x90}}, 0x20) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:53 executing program 4: write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xffcb) 20:03:53 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) (async) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000000)=[{0x22, 0x0, [0x4, 0x80000001, 0x7f, 0x408, 0x400, 0x84, 0x1, 0x100, 0x10000, 0xfff, 0xfff, 0xff, 0x9, 0x92, 0xa8, 0x8]}, {0x10, 0x0, [0x7, 0x99, 0x40, 0x7, 0xc4, 0x8000, 0x3, 0x2, 0xfffffffc, 0x50b9a1da, 0x7fffffff, 0x8, 0xffff, 0x5, 0x0, 0x8]}], r1, 0x1, 0x1, 0x90}}, 0x20) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:53 executing program 0: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f0000000240)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r0, 0x718}}, 0x18) socketpair(0x19, 0x5, 0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$tipc(r1, &(0x7f0000000080)=@name, &(0x7f00000000c0)=0x10) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) 20:03:53 executing program 4: write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xffcb) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000000)=[{0x22, 0x0, [0x4, 0x80000001, 0x7f, 0x408, 0x400, 0x84, 0x1, 0x100, 0x10000, 0xfff, 0xfff, 0xff, 0x9, 0x92, 0xa8, 0x8]}, {0x10, 0x0, [0x7, 0x99, 0x40, 0x7, 0xc4, 0x8000, 0x3, 0x2, 0xfffffffc, 0x50b9a1da, 0x7fffffff, 0x8, 0xffff, 0x5, 0x0, 0x8]}], r1, 0x1, 0x1, 0x90}}, 0x20) 20:03:53 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000000)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = fsmount(0xffffffffffffffff, 0x1, 0x4a) fspick(r3, &(0x7f0000000000)='./file0\x00', 0x1) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 4: write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xffcb) 20:03:53 executing program 0: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f0000000240)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r0, 0x718}}, 0x18) socketpair(0x19, 0x5, 0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$tipc(r1, &(0x7f0000000080)=@name, &(0x7f00000000c0)=0x10) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0), 0x106, 0x1}}, 0x20) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f0000000240)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r0, 0x718}}, 0x18) (async) socketpair(0x19, 0x5, 0x8, &(0x7f0000000040)) (async) getsockname$tipc(r1, &(0x7f0000000080)=@name, &(0x7f00000000c0)=0x10) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x80000000) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) r3 = fsmount(0xffffffffffffffff, 0x1, 0x4a) fspick(r3, &(0x7f0000000000)='./file0\x00', 0x1) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x80000000) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(0x0, 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = fsmount(0xffffffffffffffff, 0x1, 0x4a) fspick(r3, &(0x7f0000000000)='./file0\x00', 0x1) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) fsmount(0xffffffffffffffff, 0x1, 0x4a) (async) fspick(r3, &(0x7f0000000000)='./file0\x00', 0x1) (async) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x80000000) 20:03:53 executing program 0: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f0000000240)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r0, 0x718}}, 0x18) socketpair(0x19, 0x5, 0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$tipc(r1, &(0x7f0000000080)=@name, &(0x7f00000000c0)=0x10) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(0x0, 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000fc0)={&(0x7f00000004c0)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x0, r5) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6000001, 0x10, r0, 0x0) 20:03:53 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="040028bd7000ffdbdf2a00f94b1dce001700", @ANYRES32, @ANYBLOB="f95100046163edccfa10a795c57070e6f96ddb897c7a0d54ae2a4a236bab9f75d4a41f5e33fa9b3b24b466cad4c14238e0d95d4003cdf1eadbc54acc77a541a6134f5e982f63294fba65df0017964eceb1f1c610f03164482952977f621a4ea54636ba07c146619a9623ada93e906d687e7be801711d56e912fe3e76df39aec12eefa105b7b0891be07e411b5bbda0a1426d442d90d2042991a222e2cbac5e1cf8ece9cc5c1af2643766acb4e5a786ddbe0c04327267432dd41bf75b3f8fd3e6bd9f24199aa33f14b8206e439795d700d4daf106dd31251c34f27ce17a3aac3c1327b44097"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000001) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0xc241) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(0x0, 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000fc0)={&(0x7f00000004c0)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x0, r5) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) socket$inet_udplite(0x2, 0x2, 0x88) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) socket$tipc(0x1e, 0x5, 0x0) (async) sendmsg$tipc(r1, &(0x7f0000000fc0)={&(0x7f00000004c0)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140), 0x13f}}, 0x20) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x0, r5) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) (async) 20:03:53 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="040028bd7000ffdbdf2a00f94b1dce001700", @ANYRES32, @ANYBLOB="f95100046163edccfa10a795c57070e6f96ddb897c7a0d54ae2a4a236bab9f75d4a41f5e33fa9b3b24b466cad4c14238e0d95d4003cdf1eadbc54acc77a541a6134f5e982f63294fba65df0017964eceb1f1c610f03164482952977f621a4ea54636ba07c146619a9623ada93e906d687e7be801711d56e912fe3e76df39aec12eefa105b7b0891be07e411b5bbda0a1426d442d90d2042991a222e2cbac5e1cf8ece9cc5c1af2643766acb4e5a786ddbe0c04327267432dd41bf75b3f8fd3e6bd9f24199aa33f14b8206e439795d700d4daf106dd31251c34f27ce17a3aac3c1327b44097"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000001) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0xc241) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6000001, 0x10, r0, 0x0) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6000001, 0x10, r0, 0x0) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, r0, 0x0) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x0) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6000001, 0x10, r0, 0x0) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6000001, 0x10, r0, 0x0) (async) 20:03:53 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000fc0)={&(0x7f00000004c0)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x0, r5) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r4}}, 0x18) 20:03:53 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="040028bd7000ffdbdf2a00f94b1dce001700", @ANYRES32, @ANYBLOB="f95100046163edccfa10a795c57070e6f96ddb897c7a0d54ae2a4a236bab9f75d4a41f5e33fa9b3b24b466cad4c14238e0d95d4003cdf1eadbc54acc77a541a6134f5e982f63294fba65df0017964eceb1f1c610f03164482952977f621a4ea54636ba07c146619a9623ada93e906d687e7be801711d56e912fe3e76df39aec12eefa105b7b0891be07e411b5bbda0a1426d442d90d2042991a222e2cbac5e1cf8ece9cc5c1af2643766acb4e5a786ddbe0c04327267432dd41bf75b3f8fd3e6bd9f24199aa33f14b8206e439795d700d4daf106dd31251c34f27ce17a3aac3c1327b44097"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000001) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0xc241) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/170, 0xaa, 0x1, &(0x7f00000000c0)=""/46, 0x2e}, &(0x7f0000000140)=0x40) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x30, 0xffffffffffffffff, 0x0) 20:03:53 executing program 2: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x0) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/170, 0xaa, 0x1, &(0x7f00000000c0)=""/46, 0x2e}, &(0x7f0000000140)=0x40) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x30, 0xffffffffffffffff, 0x0) 20:03:53 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x1, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r2, 0xb40}}, 0x10) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000101000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f0000000080)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x6}}, 0x10) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r6}}, 0x18) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/170, 0xaa, 0x1, &(0x7f00000000c0)=""/46, 0x2e}, &(0x7f0000000140)=0x40) (async) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x30, 0xffffffffffffffff, 0x0) 20:03:53 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x0) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:53 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x0, 0xffffffffffffffff, 0x1}) r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x193}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0x4) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) (async) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r2, 0xb40}}, 0x10) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000101000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f0000000080)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x6}}, 0x10) (async) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r6}}, 0x18) 20:03:53 executing program 2: perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x0, 0xffffffffffffffff, 0x1}) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) (async) sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x193}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0x4) (async) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 20:03:53 executing program 4: syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xffcb) 20:03:53 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x0, 0xffffffffffffffff, 0x1}) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x193}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0x4) (async) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 20:03:53 executing program 2: perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 3: write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x9, @empty, 0x8001}, {0xa, 0x4e23, 0x200, @mcast1, 0x4}, 0xffffffffffffffff, 0x2}}, 0x48) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000080)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x3f, "d0fa1f", "89f7bc980e782952f461ae4d588d586219a3598800e21e3f8974741481697eda3ef389f8710eb6d553f6590114b1cde16d47c759bdfcc90497e7a28ecefba315531c76b194d4a94a7fddd345ef8b3433cc05e8922fc1b83487e6bd0db0d8c4c25891ed92375103fe9b6d91f707a0fbf18a515f33e533d2d8baad05740eace2f0d2b8a7f61ded1ffffba861bfeea65e6da15c64aedcb20f4d777238fb234a8f9d60ba070e50d62e1777d5929add22c2b726cc0f9e9fed94dd68e72d5d9d7c2d1236cbac139d841e0509276cadc1dec218a96d0caf0ba9807405becdc206583e78e3fdd1207333687dd03fb1f23bec58a4f2c2be9ce528daba773be6ccd77e981e"}}, 0x110) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 4: syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xffcb) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) (async) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r2, 0xb40}}, 0x10) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000101000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f0000000080)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x6}}, 0x10) (async, rerun: 64) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r6}}, 0x18) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf6edd0000000c0002555a1513e40f7478f512c7b5000000010000000000000000000000000000000008001c4b94dacc0a5a394f04a3cf24af2ec5d6b3749b5e592f674ab9da331f50bf22c96587b023a8ecb544a190f3dc57fd2fac87157a12570763293f0832fa7ed0149ceefb88e148c105ebf0abe2c9c7bcbf22734e3b86837ad4bb19ffad4a04838ec7b37b3cd770a3d8a70520694f5c29a03ed4c99ff71a2b748477478b1f7812b66f67bf316f3a5add535b458353c1597cd631bf820e7c8852b1f138ede8dbc6f04c8844e6a6995aaecce881db0c77ca12a1db6b13fd446c3f1917f8068c8b6edffa38c89e67f9c472d2e967", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100b700ecff0c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = fsopen(&(0x7f0000000040)='efivarfs\x00', 0x0) fsmount(r1, 0x0, 0x81) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x9, @empty, 0x8001}, {0xa, 0x4e23, 0x200, @mcast1, 0x4}, 0xffffffffffffffff, 0x2}}, 0x48) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000080)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x3f, "d0fa1f", "89f7bc980e782952f461ae4d588d586219a3598800e21e3f8974741481697eda3ef389f8710eb6d553f6590114b1cde16d47c759bdfcc90497e7a28ecefba315531c76b194d4a94a7fddd345ef8b3433cc05e8922fc1b83487e6bd0db0d8c4c25891ed92375103fe9b6d91f707a0fbf18a515f33e533d2d8baad05740eace2f0d2b8a7f61ded1ffffba861bfeea65e6da15c64aedcb20f4d777238fb234a8f9d60ba070e50d62e1777d5929add22c2b726cc0f9e9fed94dd68e72d5d9d7c2d1236cbac139d841e0509276cadc1dec218a96d0caf0ba9807405becdc206583e78e3fdd1207333687dd03fb1f23bec58a4f2c2be9ce528daba773be6ccd77e981e"}}, 0x110) 20:03:53 executing program 4: syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xffcb) 20:03:53 executing program 2: perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000a000000000000000300000d0000001f00000000001a00000f000000000000000000000000000000070000000141c96eb902c900000400000000040000000000000000000000008a15e2"], &(0x7f0000000540)=""/205, 0x5e, 0xcd, 0x1}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000280)={0x1, 0x10, 0xfa00, {&(0x7f0000000240), r2}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0xff}}, 0x18) 20:03:53 executing program 3: write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x9, @empty, 0x8001}, {0xa, 0x4e23, 0x200, @mcast1, 0x4}, 0xffffffffffffffff, 0x2}}, 0x48) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000080)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x3f, "d0fa1f", "89f7bc980e782952f461ae4d588d586219a3598800e21e3f8974741481697eda3ef389f8710eb6d553f6590114b1cde16d47c759bdfcc90497e7a28ecefba315531c76b194d4a94a7fddd345ef8b3433cc05e8922fc1b83487e6bd0db0d8c4c25891ed92375103fe9b6d91f707a0fbf18a515f33e533d2d8baad05740eace2f0d2b8a7f61ded1ffffba861bfeea65e6da15c64aedcb20f4d777238fb234a8f9d60ba070e50d62e1777d5929add22c2b726cc0f9e9fed94dd68e72d5d9d7c2d1236cbac139d841e0509276cadc1dec218a96d0caf0ba9807405becdc206583e78e3fdd1207333687dd03fb1f23bec58a4f2c2be9ce528daba773be6ccd77e981e"}}, 0x110) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x9, @empty, 0x8001}, {0xa, 0x4e23, 0x200, @mcast1, 0x4}, 0xffffffffffffffff, 0x2}}, 0x48) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000080)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x3f, "d0fa1f", "89f7bc980e782952f461ae4d588d586219a3598800e21e3f8974741481697eda3ef389f8710eb6d553f6590114b1cde16d47c759bdfcc90497e7a28ecefba315531c76b194d4a94a7fddd345ef8b3433cc05e8922fc1b83487e6bd0db0d8c4c25891ed92375103fe9b6d91f707a0fbf18a515f33e533d2d8baad05740eace2f0d2b8a7f61ded1ffffba861bfeea65e6da15c64aedcb20f4d777238fb234a8f9d60ba070e50d62e1777d5929add22c2b726cc0f9e9fed94dd68e72d5d9d7c2d1236cbac139d841e0509276cadc1dec218a96d0caf0ba9807405becdc206583e78e3fdd1207333687dd03fb1f23bec58a4f2c2be9ce528daba773be6ccd77e981e"}}, 0x110) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x7, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf6edd0000000c0002555a1513e40f7478f512c7b5000000010000000000000000000000000000000008001c4b94dacc0a5a394f04a3cf24af2ec5d6b3749b5e592f674ab9da331f50bf22c96587b023a8ecb544a190f3dc57fd2fac87157a12570763293f0832fa7ed0149ceefb88e148c105ebf0abe2c9c7bcbf22734e3b86837ad4bb19ffad4a04838ec7b37b3cd770a3d8a70520694f5c29a03ed4c99ff71a2b748477478b1f7812b66f67bf316f3a5add535b458353c1597cd631bf820e7c8852b1f138ede8dbc6f04c8844e6a6995aaecce881db0c77ca12a1db6b13fd446c3f1917f8068c8b6edffa38c89e67f9c472d2e967", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100b700ecff0c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r1 = fsopen(&(0x7f0000000040)='efivarfs\x00', 0x0) fsmount(r1, 0x0, 0x81) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000a000000000000000300000d0000001f00000000001a00000f000000000000000000000000000000070000000141c96eb902c900000400000000040000000000000000000000008a15e2"], &(0x7f0000000540)=""/205, 0x5e, 0xcd, 0x1}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000280)={0x1, 0x10, 0xfa00, {&(0x7f0000000240), r2}}, 0x18) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0xff}}, 0x18) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 3: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x3) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) r1 = syz_io_uring_setup(0x3710, &(0x7f0000000040)={0x0, 0x229e, 0x2, 0x1, 0x275, 0x0, r0}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) mmap$IORING_OFF_SQES(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x100000f, 0x100010, r1, 0x10000000) socket$xdp(0x2c, 0x3, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4, 0x10, r2, 0x180000000) 20:03:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000a000000000000000300000d0000001f00000000001a00000f000000000000000000000000000000070000000141c96eb902c900000400000000040000000000000000000000008a15e2"], &(0x7f0000000540)=""/205, 0x5e, 0xcd, 0x1}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000280)={0x1, 0x10, 0xfa00, {&(0x7f0000000240), r2}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0xff}}, 0x18) 20:03:53 executing program 3: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x3) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) r1 = syz_io_uring_setup(0x3710, &(0x7f0000000040)={0x0, 0x229e, 0x2, 0x1, 0x275, 0x0, r0}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) mmap$IORING_OFF_SQES(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x100000f, 0x100010, r1, 0x10000000) socket$xdp(0x2c, 0x3, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4, 0x10, r2, 0x180000000) syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x3) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) (async) syz_io_uring_setup(0x3710, &(0x7f0000000040)={0x0, 0x229e, 0x2, 0x1, 0x275, 0x0, r0}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (async) mmap$IORING_OFF_SQES(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x100000f, 0x100010, r1, 0x10000000) (async) socket$xdp(0x2c, 0x3, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mmap$xdp(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4, 0x10, r2, 0x180000000) (async) 20:03:53 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf6edd0000000c0002555a1513e40f7478f512c7b5000000010000000000000000000000000000000008001c4b94dacc0a5a394f04a3cf24af2ec5d6b3749b5e592f674ab9da331f50bf22c96587b023a8ecb544a190f3dc57fd2fac87157a12570763293f0832fa7ed0149ceefb88e148c105ebf0abe2c9c7bcbf22734e3b86837ad4bb19ffad4a04838ec7b37b3cd770a3d8a70520694f5c29a03ed4c99ff71a2b748477478b1f7812b66f67bf316f3a5add535b458353c1597cd631bf820e7c8852b1f138ede8dbc6f04c8844e6a6995aaecce881db0c77ca12a1db6b13fd446c3f1917f8068c8b6edffa38c89e67f9c472d2e967", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100b700ecff0c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = fsopen(&(0x7f0000000040)='efivarfs\x00', 0x0) fsmount(r1, 0x0, 0x81) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf6edd0000000c0002555a1513e40f7478f512c7b5000000010000000000000000000000000000000008001c4b94dacc0a5a394f04a3cf24af2ec5d6b3749b5e592f674ab9da331f50bf22c96587b023a8ecb544a190f3dc57fd2fac87157a12570763293f0832fa7ed0149ceefb88e148c105ebf0abe2c9c7bcbf22734e3b86837ad4bb19ffad4a04838ec7b37b3cd770a3d8a70520694f5c29a03ed4c99ff71a2b748477478b1f7812b66f67bf316f3a5add535b458353c1597cd631bf820e7c8852b1f138ede8dbc6f04c8844e6a6995aaecce881db0c77ca12a1db6b13fd446c3f1917f8068c8b6edffa38c89e67f9c472d2e967", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100b700ecff0c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsopen(&(0x7f0000000040)='efivarfs\x00', 0x0) (async) fsmount(r1, 0x0, 0x81) (async) 20:03:53 executing program 3: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x3) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) r1 = syz_io_uring_setup(0x3710, &(0x7f0000000040)={0x0, 0x229e, 0x2, 0x1, 0x275, 0x0, r0}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) mmap$IORING_OFF_SQES(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x100000f, 0x100010, r1, 0x10000000) socket$xdp(0x2c, 0x3, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4, 0x10, r2, 0x180000000) syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x3) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) (async) syz_io_uring_setup(0x3710, &(0x7f0000000040)={0x0, 0x229e, 0x2, 0x1, 0x275, 0x0, r0}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (async) mmap$IORING_OFF_SQES(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x100000f, 0x100010, r1, 0x10000000) (async) socket$xdp(0x2c, 0x3, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mmap$xdp(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4, 0x10, r2, 0x180000000) (async) 20:03:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:53 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000562f6afcd404aebe0ee4d0fe36dd99a0ffc5c6f0099dc7df7ef174121b210b50972100a33380", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r5, 0xff}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x5e, 0x1) write$P9_RLCREATE(r1, &(0x7f0000000080)={0x18, 0xf, 0x2, {{0x0, 0x0, 0x7}, 0x3}}, 0x18) r2 = syz_io_uring_setup(0x3088, &(0x7f00000000c0)={0x0, 0xab97, 0x38, 0x3, 0x205}, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000140), &(0x7f0000000180)) r3 = openat$cgroup_freezer_state(r0, &(0x7f00000001c0), 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r5 = perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x3f, 0x8, 0x9, 0xff, 0x0, 0x1, 0x40002, 0x4, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000200), 0x5}, 0x10005, 0x7fffffffffffffff, 0x4, 0x1, 0x6, 0xaac, 0x4, 0x0, 0x54aa, 0x0, 0x200}, 0xffffffffffffffff, 0x2, r1, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f0000000300)={0xa7b, 0x0, &(0x7f00000002c0)=[r3, r1, r1, r4, 0xffffffffffffffff, r5, r0]}, 0x7) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d01, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r7 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000562f6afcd404aebe0ee4d0fe36dd99a0ffc5c6f0099dc7df7ef174121b210b50972100a33380", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r5, 0xff}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000562f6afcd404aebe0ee4d0fe36dd99a0ffc5c6f0099dc7df7ef174121b210b50972100a33380", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) (async) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r5, 0xff}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:54 executing program 3: io_uring_setup(0x1eab, &(0x7f0000000180)={0x0, 0xcdec, 0x1, 0x0, 0x16c}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000001, 0x2010, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000040)={0x15, 0xffffffffffffffaf, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x2, @mcast2, 0x80}, @in6={0xa, 0x4e22, 0x8, @loopback, 0x5}}}, 0x118) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$cgroup_int(r1, &(0x7f0000000200)=0x3, 0x12) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x0) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x5e, 0x1) write$P9_RLCREATE(r1, &(0x7f0000000080)={0x18, 0xf, 0x2, {{0x0, 0x0, 0x7}, 0x3}}, 0x18) (async) r2 = syz_io_uring_setup(0x3088, &(0x7f00000000c0)={0x0, 0xab97, 0x38, 0x3, 0x205}, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (async) r3 = openat$cgroup_freezer_state(r0, &(0x7f00000001c0), 0x2, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r5 = perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x3f, 0x8, 0x9, 0xff, 0x0, 0x1, 0x40002, 0x4, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000200), 0x5}, 0x10005, 0x7fffffffffffffff, 0x4, 0x1, 0x6, 0xaac, 0x4, 0x0, 0x54aa, 0x0, 0x200}, 0xffffffffffffffff, 0x2, r1, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f0000000300)={0xa7b, 0x0, &(0x7f00000002c0)=[r3, r1, r1, r4, 0xffffffffffffffff, r5, r0]}, 0x7) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r7 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 3: io_uring_setup(0x1eab, &(0x7f0000000180)={0x0, 0xcdec, 0x1, 0x0, 0x16c}) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000001, 0x2010, 0xffffffffffffffff, 0x0) (async) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000040)={0x15, 0xffffffffffffffaf, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x2, @mcast2, 0x80}, @in6={0xa, 0x4e22, 0x8, @loopback, 0x5}}}, 0x118) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) write$cgroup_int(r1, &(0x7f0000000200)=0x3, 0x12) (async, rerun: 32) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000562f6afcd404aebe0ee4d0fe36dd99a0ffc5c6f0099dc7df7ef174121b210b50972100a33380", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (rerun: 64) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) (async) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r5, 0xff}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x5e, 0x1) write$P9_RLCREATE(r1, &(0x7f0000000080)={0x18, 0xf, 0x2, {{0x0, 0x0, 0x7}, 0x3}}, 0x18) r2 = syz_io_uring_setup(0x3088, &(0x7f00000000c0)={0x0, 0xab97, 0x38, 0x3, 0x205}, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000140), &(0x7f0000000180)) r3 = openat$cgroup_freezer_state(r0, &(0x7f00000001c0), 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r5 = perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x3f, 0x8, 0x9, 0xff, 0x0, 0x1, 0x40002, 0x4, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000200), 0x5}, 0x10005, 0x7fffffffffffffff, 0x4, 0x1, 0x6, 0xaac, 0x4, 0x0, 0x54aa, 0x0, 0x200}, 0xffffffffffffffff, 0x2, r1, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f0000000300)={0xa7b, 0x0, &(0x7f00000002c0)=[r3, r1, r1, r4, 0xffffffffffffffff, r5, r0]}, 0x7) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) syz_open_dev$vcsn(&(0x7f0000000040), 0x5e, 0x1) (async) write$P9_RLCREATE(r1, &(0x7f0000000080)={0x18, 0xf, 0x2, {{0x0, 0x0, 0x7}, 0x3}}, 0x18) (async) syz_io_uring_setup(0x3088, &(0x7f00000000c0)={0x0, 0xab97, 0x38, 0x3, 0x205}, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (async) openat$cgroup_freezer_state(r0, &(0x7f00000001c0), 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x3f, 0x8, 0x9, 0xff, 0x0, 0x1, 0x40002, 0x4, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000200), 0x5}, 0x10005, 0x7fffffffffffffff, 0x4, 0x1, 0x6, 0xaac, 0x4, 0x0, 0x54aa, 0x0, 0x200}, 0xffffffffffffffff, 0x2, r1, 0x1) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f0000000300)={0xa7b, 0x0, &(0x7f00000002c0)=[r3, r1, r1, r4, 0xffffffffffffffff, r5, r0]}, 0x7) (async) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000080)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r5}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0x2, {0x3f, 0x0, "e5c0cae3869ac89acc942718ac43b6ad17859a5b994aec8a133975e9975365095314b864bee27a5c8431b8f19bfa97178208d5f531ea5bc6cec578a24a399f22e5dc8bcdb134a2e66463dee9a9a0d0eaba2b81bfe62723b39552b2ee613221b7899ead43dc8eb6faf4b1464a13ab48582efc27adfacbfd4a5062b29bae45692021bcc52708c2840d4f3d0834ef2cc5612f1238b3dc52d8abc2d4926d926c349fca40a40e558bfead2fb05893b787d50bcc145f1005d37936069a2a363d996ae4fd4bf81290b40bbdf72c5e4974aaab419978dcda5c6f9c07f6dc6c95e1b7931edd0611f5c01d5ade1a18b2010daabdefa42a68b96d2526165f79d41076e04753", 0x9, 0x40, 0x2, 0x7f, 0x7, 0x7, 0x81, 0x1}, r3}}, 0x128) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r7}}, 0x18) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000680), r3, 0x1}}, 0x18) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r3, 0xe62) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r7 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r8}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r6, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r5, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f0000000100)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 0: io_uring_register$IORING_REGISTER_PROBE(0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x27) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 3: io_uring_setup(0x1eab, &(0x7f0000000180)={0x0, 0xcdec, 0x1, 0x0, 0x16c}) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000001, 0x2010, 0xffffffffffffffff, 0x0) (async) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000040)={0x15, 0xffffffffffffffaf, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x2, @mcast2, 0x80}, @in6={0xa, 0x4e22, 0x8, @loopback, 0x5}}}, 0x118) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$cgroup_int(r1, &(0x7f0000000200)=0x3, 0x12) (async, rerun: 64) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x0) (rerun: 64) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000080)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r5}}, 0x18) (async) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0x2, {0x3f, 0x0, "e5c0cae3869ac89acc942718ac43b6ad17859a5b994aec8a133975e9975365095314b864bee27a5c8431b8f19bfa97178208d5f531ea5bc6cec578a24a399f22e5dc8bcdb134a2e66463dee9a9a0d0eaba2b81bfe62723b39552b2ee613221b7899ead43dc8eb6faf4b1464a13ab48582efc27adfacbfd4a5062b29bae45692021bcc52708c2840d4f3d0834ef2cc5612f1238b3dc52d8abc2d4926d926c349fca40a40e558bfead2fb05893b787d50bcc145f1005d37936069a2a363d996ae4fd4bf81290b40bbdf72c5e4974aaab419978dcda5c6f9c07f6dc6c95e1b7931edd0611f5c01d5ade1a18b2010daabdefa42a68b96d2526165f79d41076e04753", 0x9, 0x40, 0x2, 0x7f, 0x7, 0x7, 0x81, 0x1}, r3}}, 0x128) (async) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r7}}, 0x18) (async) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000680), r3, 0x1}}, 0x18) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 3: write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x585, @empty, 0xffe}}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r0}}, 0x18) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @empty}, 0x23}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x118) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x2131, 0xffffffffffffffff, 0x80000000) 20:03:54 executing program 0: io_uring_register$IORING_REGISTER_PROBE(0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x27) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r6 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, r7) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r7}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r5, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r4, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r3, @ANYBLOB="88c60000", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000fe63a95b082f52f9025a87d06ca7e7024cc3fed64e68c84d96676eb13c44080457c9e017629b3661e1e2bf506ff830919db5168da8ab5b315a03b25286f762936f16c736f77126aa94504a17c2fabc39556851d12d3baef7e92723b23e34a9b56c4a996dfc1cf60afea2d94ab302e1b65eec1dda38f7cab72935e92e8e092fe6a8"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 64) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (rerun: 64) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000080)={0x5, 0x10, 0xfa00, {&(0x7f0000000480), r5}}, 0x18) (async) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0x2, {0x3f, 0x0, "e5c0cae3869ac89acc942718ac43b6ad17859a5b994aec8a133975e9975365095314b864bee27a5c8431b8f19bfa97178208d5f531ea5bc6cec578a24a399f22e5dc8bcdb134a2e66463dee9a9a0d0eaba2b81bfe62723b39552b2ee613221b7899ead43dc8eb6faf4b1464a13ab48582efc27adfacbfd4a5062b29bae45692021bcc52708c2840d4f3d0834ef2cc5612f1238b3dc52d8abc2d4926d926c349fca40a40e558bfead2fb05893b787d50bcc145f1005d37936069a2a363d996ae4fd4bf81290b40bbdf72c5e4974aaab419978dcda5c6f9c07f6dc6c95e1b7931edd0611f5c01d5ade1a18b2010daabdefa42a68b96d2526165f79d41076e04753", 0x9, 0x40, 0x2, 0x7f, 0x7, 0x7, 0x81, 0x1}, r3}}, 0x128) (async) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async, rerun: 32) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r7}}, 0x18) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000680), r3, 0x1}}, 0x18) 20:03:54 executing program 0: io_uring_register$IORING_REGISTER_PROBE(0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x27) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_PROBE(0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x27) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0xffffffffffffffff, 0x8040) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) (async) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 3: write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x585, @empty, 0xffe}}}, 0x30) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r0}}, 0x18) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @empty}, 0x23}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x118) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x2131, 0xffffffffffffffff, 0x80000000) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r6 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, r7) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r7}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r5, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r4, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) 20:03:54 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x80) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r2, 0x2}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 3: write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x585, @empty, 0xffe}}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r0}}, 0x18) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @empty}, 0x23}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x118) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x2131, 0xffffffffffffffff, 0x80000000) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x585, @empty, 0xffe}}}, 0x30) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x2, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r0}}, 0x18) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @empty}, 0x23}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x118) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x2131, 0xffffffffffffffff, 0x80000000) (async) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(0x0, 0xff, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r5 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r6) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r6}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r4, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000580)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x12}}, 0x10) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) shmget(0x0, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async, rerun: 32) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r2, 0x2}}, 0x10) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async, rerun: 32) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000540)={0x3, 0x0, &(0x7f0000000500)=[0xffffffffffffffff, r4, r5, r1, r6]}, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0x6) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r7, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r8, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f00000001c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000100), r7}}, 0x18) r9 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r10 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r10, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r9, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {r7, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r2, 0x2}}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) shmget(0x0, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r5 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r6) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r6}}, 0xd8d) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd70735e3405948f849fd400ffdbdf25010000000c00f1f1aa228bee9dba8c", @ANYRES32=r4, @ANYBLOB="080001007efb4e9f6915dd3cf61a1a9b633cce224f6a49117501000000854ea4235d77b927632719da1da291e8ba90e69c320f058822e7b5a52bd7db6e12640e39f78ceb1b4db0a20ab8b8bb4ef9bb5ef67c47742b14378ec5c32ddc494d38c3298bbca059b101f8e6aefd455913c1dce5f110d4eb6be61a6cff2f1c8877cf82a5dc10e70403879c0d18ceb732366a338dc5628bf54628e0f4d1a2abc54f4526d159ae35a7207160955315aa926e85777001d4b509da", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="a3ed72ff4b057a0800012000220100000000000054534e2996acb8605be67a948887de9adad3c04794a464f5e38661f6980b7ab74e07b71d5b2ff45e50c5f2bece3cf495f12d51644e4f1500039b3d0e0c9cfdd1c89dd21aa522809dc6077254b455f32bdd150fe30be74ec527ba34bcf437eb39d051f9c58b1fdff7"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = syz_io_uring_setup(0x221, &(0x7f0000000380)={0x0, 0xf29e, 0x1, 0x2, 0x2f9}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xd3c1, 0x109040) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000540)={0x3, 0x0, &(0x7f0000000500)=[0xffffffffffffffff, r4, r5, r1, r6]}, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r7}}, 0x6) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r7, 0xac}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000680)={0x9, 0x108, 0xfa00, {r8, 0x0, '\x00\ae', "ee425e45877bebf6accf6d2a3a93cd2d4c1b98ef54920eff07f9be7d23e5eee871acc538891d05414a4172a16cf357ca57c057c899f758b0f1dd561c0c842711f933f3ab3844e3d44fee5111baa9965632657cde5418e8e080464be727178a0a5e769c32c00ace97c3a18f488525772c160e23e226ba1dffff9cf9b8846dbb881a7fef85800000571d98738d7207957794535bf75efaa28b3e0f103116386b06312be4713afe65df117a86945e97fbe5a90915c24fb2e082d59813096e8a762969fcb23691b6252100f7ff000000000000000000d1b3e1130000ff0000050000000000000000000800000000000000000000000000000000001000"}}, 0x110) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f00000001c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000100), r7}}, 0x18) r9 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x1, 0x80) r10 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r10, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) io_uring_register$IORING_REGISTER_FILES_UPDATE(r9, 0x6, &(0x7f00000007c0)={0x5, 0x0, &(0x7f0000000640)=[r4, r2, r1, 0xffffffffffffffff]}, 0x4) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x0) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r5 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r6) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc, 0x0, {0x0, r6}}, 0xd8d) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) shmget(0x0, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) shmget(0x0, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) (async) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0xfffffff0, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x803890cdbbb21e60}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x0) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000080)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x90) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r4 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0xa, 0x0, r5) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 3: prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000040)='@\x00') mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000000)=0x7, 0x4) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x0) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x4e21, @private=0xa010102}}}, 0x90) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r4 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 3: prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000040)='@\x00') mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000000)=0x7, 0x4) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000040)='@\x00') (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000000)=0x7, 0x4) (async) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0xfffffff0, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x803890cdbbb21e60}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (fail_nth: 1) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0xfffffff0, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x803890cdbbb21e60}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 3: prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000040)='@\x00') (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000000)=0x7, 0x4) (rerun: 64) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x11, r2, 0x10000000) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="58cdbda261d3f91a0a84687b0e879be15ee68d9b83e9b54cdf34993dd6868a4733f7e451da018ef6150b435edeb12799c8c10d650bde1b1c2fdd1d80b7f28c6880b73bfa6e1f6a5a3eb7d822b4f359718b57b4d60a5de14360250abce82d5f6621d698d5d59c05a789a7e36a18c976b7b7b246b58380b178da76555d5aed461bb7ae0f05b7bf1496c9d3de598102a040b2edadb97bc747e4a95167634c83691cb2ff3489f48df1eeae8dad7e5327a9dd67714a3b3ff446982463dce40698b838b45fe5adcc78e709dc931275582197047ba3bef2a03eb57f42f4b900000000", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000000)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x11, r2, 0x10000000) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="58cdbda261d3f91a0a84687b0e879be15ee68d9b83e9b54cdf34993dd6868a4733f7e451da018ef6150b435edeb12799c8c10d650bde1b1c2fdd1d80b7f28c6880b73bfa6e1f6a5a3eb7d822b4f359718b57b4d60a5de14360250abce82d5f6621d698d5d59c05a789a7e36a18c976b7b7b246b58380b178da76555d5aed461bb7ae0f05b7bf1496c9d3de598102a040b2edadb97bc747e4a95167634c83691cb2ff3489f48df1eeae8dad7e5327a9dd67714a3b3ff446982463dce40698b838b45fe5adcc78e709dc931275582197047ba3bef2a03eb57f42f4b900000000", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000000)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) [ 1031.977919][ T3517] FAULT_INJECTION: forcing a failure. [ 1031.977919][ T3517] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1031.991016][ T3517] CPU: 1 PID: 3517 Comm: syz-executor.0 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1032.001946][ T3517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1032.012033][ T3517] Call Trace: [ 1032.015308][ T3517] [ 1032.018240][ T3517] dump_stack_lvl+0xd6/0x122 [ 1032.022840][ T3517] dump_stack+0x11/0x12 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x11, r2, 0x10000000) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="58cdbda261d3f91a0a84687b0e879be15ee68d9b83e9b54cdf34993dd6868a4733f7e451da018ef6150b435edeb12799c8c10d650bde1b1c2fdd1d80b7f28c6880b73bfa6e1f6a5a3eb7d822b4f359718b57b4d60a5de14360250abce82d5f6621d698d5d59c05a789a7e36a18c976b7b7b246b58380b178da76555d5aed461bb7ae0f05b7bf1496c9d3de598102a040b2edadb97bc747e4a95167634c83691cb2ff3489f48df1eeae8dad7e5327a9dd67714a3b3ff446982463dce40698b838b45fe5adcc78e709dc931275582197047ba3bef2a03eb57f42f4b900000000", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000000)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) [ 1032.027057][ T3517] should_fail+0x230/0x240 [ 1032.031483][ T3517] should_fail_usercopy+0x16/0x20 [ 1032.036534][ T3517] _copy_to_user+0x1a/0x90 [ 1032.040955][ T3517] simple_read_from_buffer+0xab/0x120 [ 1032.046340][ T3517] proc_fail_nth_read+0x10d/0x150 [ 1032.051415][ T3517] ? proc_fault_inject_write+0x230/0x230 [ 1032.057061][ T3517] vfs_read+0x1a1/0x6a0 [ 1032.061220][ T3517] ? __fget_files+0x1d2/0x210 [ 1032.065927][ T3517] ksys_read+0xe8/0x1a0 [ 1032.070151][ T3517] __x64_sys_read+0x3e/0x50 [ 1032.074737][ T3517] do_syscall_64+0x2b/0x70 [ 1032.079197][ T3517] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1032.085098][ T3517] RIP: 0033:0x7f1431c0ac9c [ 1032.089539][ T3517] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1032.109174][ T3517] RSP: 002b:00007f14313ce160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1032.117668][ T3517] RAX: ffffffffffffffda RBX: 00007f1431d6af60 RCX: 00007f1431c0ac9c 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="49000000290200e19db7838002000000040000000000000000040000000000000007002e2f66696c6530000400000007000000000009000500007459086977b155530004ef2d2f66696c653000000000004ffc0c53ecbedbc01c30d3bff27c78843a058b958841780b1a792564"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000)=0x6, 0x4) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000100)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x419f107f, @private2, 0x3}}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x33, 0xfa00, {0x2, 0x0, 0x2, 0x3}}, 0x32) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r2, 0x0, 0x2, 0x4}}, 0x20) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000)=0x6, 0x4) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, r3, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1032.125623][ T3517] RDX: 000000000000000f RSI: 00007f14313ce1e0 RDI: 0000000000000004 [ 1032.133578][ T3517] RBP: 00007f14313ce1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1032.141621][ T3517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1032.149633][ T3517] R13: 00007ffef9be769f R14: 00007f14313ce300 R15: 0000000000022000 [ 1032.157663][ T3517] 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xac) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000100)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x419f107f, @private2, 0x3}}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x33, 0xfa00, {0x2, 0x0, 0x2, 0x3}}, 0x32) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r2, 0x0, 0x2, 0x4}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000100)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x419f107f, @private2, 0x3}}}, 0x30) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x33, 0xfa00, {0x2, 0x0, 0x2, 0x3}}, 0x32) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r2, 0x0, 0x2, 0x4}}, 0x20) (async) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000)=0x6, 0x4) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000)=0x6, 0x4) (async) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000100)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x419f107f, @private2, 0x3}}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x33, 0xfa00, {0x2, 0x0, 0x2, 0x3}}, 0x32) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r2, 0x0, 0x2, 0x4}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000100)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x419f107f, @private2, 0x3}}}, 0x30) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x33, 0xfa00, {0x2, 0x0, 0x2, 0x3}}, 0x32) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r2, 0x0, 0x2, 0x4}}, 0x20) (async) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x87c00ac) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r2 = fsmount(0xffffffffffffffff, 0x0, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x40010, r2, 0xe62) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x2, 0x7, 0x1, 0x7}, {0x5, 0x3, 0x4}, {0x8000, 0x1, 0x1, 0x6}, {0x8, 0x2, 0x1f, 0x29b}, {0x7, 0xff, 0x5, 0x7fff}, {0x6, 0x7f, 0x80, 0xd0}, {0x76, 0x1, 0x6, 0x1}]}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x110, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) fsmount(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x7ffff000) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r3, 0xedf}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x2, 0x7, 0x1, 0x7}, {0x5, 0x3, 0x4}, {0x8000, 0x1, 0x1, 0x6}, {0x8, 0x2, 0x1f, 0x29b}, {0x7, 0xff, 0x5, 0x7fff}, {0x6, 0x7f, 0x80, 0xd0}, {0x76, 0x1, 0x6, 0x1}]}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x110, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x2, 0x7, 0x1, 0x7}, {0x5, 0x3, 0x4}, {0x8000, 0x1, 0x1, 0x6}, {0x8, 0x2, 0x1f, 0x29b}, {0x7, 0xff, 0x5, 0x7fff}, {0x6, 0x7f, 0x80, 0xd0}, {0x76, 0x1, 0x6, 0x1}]}) (async) fsmount(0xffffffffffffffff, 0x0, 0x8) (async) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x110, 0xffffffffffffffff, 0x0) (async) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x7ffffffff000) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r3, 0xedf}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x7ffffffffffc00ab) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r3, 0xedf}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:54 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x2, 0x7, 0x1, 0x7}, {0x5, 0x3, 0x4}, {0x8000, 0x1, 0x1, 0x6}, {0x8, 0x2, 0x1f, 0x29b}, {0x7, 0xff, 0x5, 0x7fff}, {0x6, 0x7f, 0x80, 0xd0}, {0x76, 0x1, 0x6, 0x1}]}) (async) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x110, 0xffffffffffffffff, 0x0) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000005, 0x2131, 0xffffffffffffffff, 0x180000000) 20:03:54 executing program 0: clock_getres(0x7, &(0x7f0000000000)) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:54 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000005, 0x2131, 0xffffffffffffffff, 0x180000000) 20:03:54 executing program 0: clock_getres(0x7, &(0x7f0000000000)) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) clock_getres(0x7, &(0x7f0000000000)) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x14605, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x5, 0x60000) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000240)={0xc, 0x8, 0xfa00, {&(0x7f00000003c0)}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r4, 0x0, 0x2, 0x4}}, 0x20) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x5, 0x60000) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000240)={0xc, 0x8, 0xfa00, {&(0x7f00000003c0)}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r4, 0x0, 0x2, 0x4}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) (async) syz_open_dev$vcsn(&(0x7f0000000200), 0x5, 0x60000) (async) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000240)={0xc, 0x8, 0xfa00, {&(0x7f00000003c0)}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0), 0x106, 0x6}}, 0x20) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r4, 0x0, 0x2, 0x4}}, 0x20) (async) 20:03:54 executing program 3: mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000005, 0x2131, 0xffffffffffffffff, 0x180000000) 20:03:54 executing program 0: clock_getres(0x7, &(0x7f0000000000)) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:54 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 4: perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockname$tipc(r0, &(0x7f0000000000), &(0x7f0000000040)=0x10) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x4, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x5, 0x60000) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000240)={0xc, 0x8, 0xfa00, {&(0x7f00000003c0)}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r4, 0x0, 0x2, 0x4}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) (async) syz_open_dev$vcsn(&(0x7f0000000200), 0x5, 0x60000) (async) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000240)={0xc, 0x8, 0xfa00, {&(0x7f00000003c0)}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0), 0x106, 0x6}}, 0x20) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r4, 0x0, 0x2, 0x4}}, 0x20) (async) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = io_uring_setup(0x79cb, &(0x7f0000000000)={0x0, 0x599e, 0x0, 0x1000001, 0xd1, 0x0, r0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x10, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000080)={0x14, 0x11, 0x1, {0x20, 0x1, 0x4}}, 0x14) r3 = accept4$tipc(r2, &(0x7f00000001c0)=@name, &(0x7f0000000100)=0x10, 0x800) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) fsmount(0xffffffffffffffff, 0x0, 0x8) r4 = accept4$tipc(r3, 0x0, &(0x7f0000000200), 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f00000000c0), &(0x7f0000000180)=0xffffffffffffff38) 20:03:54 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x5, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:54 executing program 4: perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:54 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$vcsn(0x0, 0x1, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:54 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) r1 = io_uring_setup(0x79cb, &(0x7f0000000000)={0x0, 0x599e, 0x0, 0x1000001, 0xd1, 0x0, r0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x10, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) (async) write$P9_RSYMLINK(r2, &(0x7f0000000080)={0x14, 0x11, 0x1, {0x20, 0x1, 0x4}}, 0x14) r3 = accept4$tipc(r2, &(0x7f00000001c0)=@name, &(0x7f0000000100)=0x10, 0x800) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) (async) fsmount(0xffffffffffffffff, 0x0, 0x8) (async, rerun: 32) r4 = accept4$tipc(r3, 0x0, &(0x7f0000000200), 0x0) (rerun: 32) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f00000000c0), &(0x7f0000000180)=0xffffffffffffff38) 20:03:55 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) getsockname$tipc(r0, &(0x7f0000000000), &(0x7f0000000040)=0x10) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000), 0x7fffffff, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r5, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r6}}, 0xc) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r6, 0x1ff}}, 0x10) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xb9f0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000), 0x7fffffff, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r5, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r6}}, 0xc) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r6, 0x1ff}}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x7fffffff, 0x2) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140), 0x111}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r5, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r6}}, 0xc) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r6, 0x1ff}}, 0x10) (async) 20:03:55 executing program 4: perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$vcsn(0x0, 0x1, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = io_uring_setup(0x79cb, &(0x7f0000000000)={0x0, 0x599e, 0x0, 0x1000001, 0xd1, 0x0, r0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x10, r1, 0x0) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) (async) write$P9_RSYMLINK(r2, &(0x7f0000000080)={0x14, 0x11, 0x1, {0x20, 0x1, 0x4}}, 0x14) r3 = accept4$tipc(r2, &(0x7f00000001c0)=@name, &(0x7f0000000100)=0x10, 0x800) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) (async) fsmount(0xffffffffffffffff, 0x0, 0x8) (async) r4 = accept4$tipc(r3, 0x0, &(0x7f0000000200), 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f00000000c0), &(0x7f0000000180)=0xffffffffffffff38) 20:03:55 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) getsockname$tipc(r0, &(0x7f0000000000), &(0x7f0000000040)=0x10) 20:03:55 executing program 4: perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$vcsn(0x0, 0x1, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:55 executing program 3: perf_event_open(&(0x7f0000000040)={0x3, 0x80, 0x2, 0x0, 0x5, 0x81, 0x0, 0x100000001, 0x14400, 0x6, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000000), 0x2}, 0x22, 0x8, 0xfffff753, 0x1, 0x2, 0xc50, 0x0, 0x0, 0x63a, 0x0, 0x80}, 0x0, 0x2, 0xffffffffffffffff, 0xa) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000000), 0x7fffffff, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r5, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r6}}, 0xc) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r6, 0x1ff}}, 0x10) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x9, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x131f02) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd, 0x0, 0x0, 0x7, 0xc}, 0x81) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000040), 0x1) syz_open_dev$vcsn(&(0x7f0000000000), 0x10001, 0x341901) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000140)=0x3) write$P9_RREADDIR(r0, 0x0, 0xffcb) r2 = syz_open_dev$vcsn(&(0x7f0000000100), 0x6, 0x0) accept4$tipc(r2, &(0x7f0000000180)=@id, &(0x7f00000001c0)=0x10, 0x1800) 20:03:55 executing program 3: perf_event_open(&(0x7f0000000040)={0x3, 0x80, 0x2, 0x0, 0x5, 0x81, 0x0, 0x100000001, 0x14400, 0x6, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000000), 0x2}, 0x22, 0x8, 0xfffff753, 0x1, 0x2, 0xc50, 0x0, 0x0, 0x63a, 0x0, 0x80}, 0x0, 0x2, 0xffffffffffffffff, 0xa) (async) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x5, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x800, @local, 0x1000}}}, 0x118) 20:03:55 executing program 3: perf_event_open(&(0x7f0000000040)={0x3, 0x80, 0x2, 0x0, 0x5, 0x81, 0x0, 0x100000001, 0x14400, 0x6, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000000), 0x2}, 0x22, 0x8, 0xfffff753, 0x1, 0x2, 0xc50, 0x0, 0x0, 0x63a, 0x0, 0x80}, 0x0, 0x2, 0xffffffffffffffff, 0xa) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x131f02) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd, 0x0, 0x0, 0x7, 0xc}, 0x81) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000040), 0x1) syz_open_dev$vcsn(&(0x7f0000000000), 0x10001, 0x341901) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000140)=0x3) write$P9_RREADDIR(r0, 0x0, 0xffcb) r2 = syz_open_dev$vcsn(&(0x7f0000000100), 0x6, 0x0) accept4$tipc(r2, &(0x7f0000000180)=@id, &(0x7f00000001c0)=0x10, 0x1800) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x3, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0xfffffe00, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0xa, 0x4e21, 0x8080000, @empty, 0x82}, r4, 0x6}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) r6 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000001, 0x40) ioctl$SIOCGETLINKNAME(r6, 0x89e0, &(0x7f0000000080)={0x1}) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0xfffffe00, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0xa, 0x4e21, 0x8080000, @empty, 0x82}, r4, 0x6}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) r6 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000001, 0x40) ioctl$SIOCGETLINKNAME(r6, 0x89e0, &(0x7f0000000080)={0x1}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100), 0x106, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0xfffffe00, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0xa, 0x4e21, 0x8080000, @empty, 0x82}, r4, 0x6}}, 0x48) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000001, 0x40) (async) ioctl$SIOCGETLINKNAME(r6, 0x89e0, &(0x7f0000000080)={0x1}) (async) 20:03:55 executing program 5: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x7ffff000) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0xa3, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x100000000) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x131f02) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd, 0x0, 0x0, 0x7, 0xc}, 0x81) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000040), 0x1) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x10001, 0x341901) r1 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000140)=0x3) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000100), 0x6, 0x0) accept4$tipc(r2, &(0x7f0000000180)=@id, &(0x7f00000001c0)=0x10, 0x1800) 20:03:55 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x100000000) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x100000000) (async) 20:03:55 executing program 5: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x7ffff000) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0xfffffe00, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0xa, 0x4e21, 0x8080000, @empty, 0x82}, r4, 0x6}}, 0x48) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) r6 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000001, 0x40) ioctl$SIOCGETLINKNAME(r6, 0x89e0, &(0x7f0000000080)={0x1}) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 1) 20:03:55 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x100000000) 20:03:55 executing program 5: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0x7ffff000) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f0000000100)={0x3}) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r4, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r4, 0x8}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x101}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, &(0x7f0000000280)={0xb, 0x10, 0xfa00, {&(0x7f0000000680), r4, 0xfffffe00}}, 0x18) r7 = fsmount(r6, 0x1, 0x1) setsockopt$inet_udp_int(r7, 0x11, 0x1, &(0x7f00000002c0)=0x8, 0x4) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xfffffffffffffc9f, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="053394a71ca2e4fa1fdcf5ffed5a9480720cb881974bb7c27713a50382be1f90b111d064bbca14d70f59793eb24bac724ca5c10f98f98ab10183212969cb695daebb53", @ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x11) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f0000000100)={0x3}) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r4, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r4, 0x8}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x101}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, &(0x7f0000000280)={0xb, 0x10, 0xfa00, {&(0x7f0000000680), r4, 0xfffffe00}}, 0x18) r7 = fsmount(r6, 0x1, 0x1) setsockopt$inet_udp_int(r7, 0x11, 0x1, &(0x7f00000002c0)=0x8, 0x4) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x106}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000), 0x13f, 0x1}}, 0x20) (async) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f0000000100)={0x3}) (async) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r4, 0x1}}, 0x18) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r4, 0x8}}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x101}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, &(0x7f0000000280)={0xb, 0x10, 0xfa00, {&(0x7f0000000680), r4, 0xfffffe00}}, 0x18) (async) fsmount(r6, 0x1, 0x1) (async) setsockopt$inet_udp_int(r7, 0x11, 0x1, &(0x7f00000002c0)=0x8, 0x4) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) (async) [ 1032.770118][ T3844] FAULT_INJECTION: forcing a failure. [ 1032.770118][ T3844] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1032.783253][ T3844] CPU: 0 PID: 3844 Comm: syz-executor.2 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1032.794197][ T3844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1032.804313][ T3844] Call Trace: [ 1032.807682][ T3844] [ 1032.810617][ T3844] dump_stack_lvl+0xd6/0x122 [ 1032.815217][ T3844] dump_stack+0x11/0x12 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x106}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) (async, rerun: 64) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f0000000100)={0x3}) (rerun: 64) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r4, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {r4, 0x8}}, 0x10) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async, rerun: 32) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x101}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, &(0x7f0000000280)={0xb, 0x10, 0xfa00, {&(0x7f0000000680), r4, 0xfffffe00}}, 0x18) (async) r7 = fsmount(r6, 0x1, 0x1) setsockopt$inet_udp_int(r7, 0x11, 0x1, &(0x7f00000002c0)=0x8, 0x4) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r6, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1032.819429][ T3844] should_fail+0x230/0x240 [ 1032.823856][ T3844] should_fail_usercopy+0x16/0x20 [ 1032.828948][ T3844] _copy_to_user+0x1a/0x90 [ 1032.833465][ T3844] simple_read_from_buffer+0xab/0x120 [ 1032.838862][ T3844] proc_fail_nth_read+0x10d/0x150 [ 1032.843920][ T3844] ? proc_fault_inject_write+0x230/0x230 [ 1032.849713][ T3844] vfs_read+0x1a1/0x6a0 [ 1032.854011][ T3844] ? __fget_files+0x1d2/0x210 [ 1032.858810][ T3844] ksys_read+0xe8/0x1a0 [ 1032.863055][ T3844] __x64_sys_read+0x3e/0x50 [ 1032.867586][ T3844] do_syscall_64+0x2b/0x70 [ 1032.872095][ T3844] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1032.877998][ T3844] RIP: 0033:0x7f905d879c9c [ 1032.882419][ T3844] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1032.902029][ T3844] RSP: 002b:00007f905d03d160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1032.910495][ T3844] RAX: ffffffffffffffda RBX: 00007f905d9d9f60 RCX: 00007f905d879c9c 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x0, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 1) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:55 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000040)={0x0, 0x6, 0xbdb}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, &(0x7f0000000000)=0x7, 0xffffffffffff0000, 0x5) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xfffffffffffffc9f, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="053394a71ca2e4fa1fdcf5ffed5a9480720cb881974bb7c27713a50382be1f90b111d064bbca14d70f59793eb24bac724ca5c10f98f98ab10183212969cb695daebb53", @ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x11) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xfffffffffffffc9f, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="053394a71ca2e4fa1fdcf5ffed5a9480720cb881974bb7c27713a50382be1f90b111d064bbca14d70f59793eb24bac724ca5c10f98f98ab10183212969cb695daebb53", @ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x11) (async) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r1, 0x0, 0xffcb) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) [ 1032.918456][ T3844] RDX: 000000000000000f RSI: 00007f905d03d1e0 RDI: 0000000000000003 [ 1032.926417][ T3844] RBP: 00007f905d03d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1032.934369][ T3844] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1032.942327][ T3844] R13: 00007fff8144120f R14: 00007f905d03d300 R15: 0000000000022000 [ 1032.950331][ T3844] 20:03:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x0, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:55 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000040)={0x0, 0x6, 0xbdb}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, &(0x7f0000000000)=0x7, 0xffffffffffff0000, 0x5) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1032.966601][ T3896] FAULT_INJECTION: forcing a failure. [ 1032.966601][ T3896] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1032.979688][ T3896] CPU: 0 PID: 3896 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1032.990694][ T3896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1033.000751][ T3896] Call Trace: [ 1033.004102][ T3896] [ 1033.007031][ T3896] dump_stack_lvl+0xd6/0x122 [ 1033.011663][ T3896] dump_stack+0x11/0x12 [ 1033.015820][ T3896] should_fail+0x230/0x240 20:03:55 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async, rerun: 32) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x0, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x4, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) [ 1033.020245][ T3896] should_fail_usercopy+0x16/0x20 [ 1033.025333][ T3896] copy_page_from_iter_atomic+0x3de/0xb80 [ 1033.031064][ T3896] ? shmem_write_begin+0x84/0x110 [ 1033.036249][ T3896] generic_perform_write+0x21a/0x3f0 [ 1033.041554][ T3896] __generic_file_write_iter+0xe3/0x280 [ 1033.047112][ T3896] ? generic_write_checks+0x256/0x290 [ 1033.052577][ T3896] generic_file_write_iter+0x75/0x130 [ 1033.058016][ T3896] vfs_write+0x71c/0x890 [ 1033.062345][ T3896] ksys_write+0xe8/0x1a0 [ 1033.066602][ T3896] __x64_sys_write+0x3e/0x50 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x10, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1033.071191][ T3896] do_syscall_64+0x2b/0x70 [ 1033.075621][ T3896] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1033.081518][ T3896] RIP: 0033:0x7f66d72200e9 [ 1033.085929][ T3896] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1033.105633][ T3896] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 2) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x4000000, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) (async, rerun: 64) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (rerun: 64) 20:03:55 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000040)={0x0, 0x6, 0xbdb}) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, &(0x7f0000000000)=0x7, 0xffffffffffff0000, 0x5) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xfffffffffffffc9f, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="053394a71ca2e4fa1fdcf5ffed5a9480720cb881974bb7c27713a50382be1f90b111d064bbca14d70f59793eb24bac724ca5c10f98f98ab10183212969cb695daebb53", @ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x11) (async) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1033.114045][ T3896] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1033.122015][ T3896] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1033.130050][ T3896] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1033.138107][ T3896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1033.146078][ T3896] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1033.154031][ T3896] 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000000, 0x80) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r5, 0xa8fa}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000000, 0x80) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) (async) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r5, 0xa8fa}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) [ 1033.179910][ T3954] FAULT_INJECTION: forcing a failure. [ 1033.179910][ T3954] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1033.193409][ T3954] CPU: 0 PID: 3954 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1033.204424][ T3954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1033.214524][ T3954] Call Trace: [ 1033.217812][ T3954] [ 1033.220745][ T3954] dump_stack_lvl+0xd6/0x122 [ 1033.225422][ T3954] dump_stack+0x11/0x12 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (rerun: 64) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8000000000000000, 0x80) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) (async) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r5, 0xa8fa}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x10000000, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1033.229661][ T3954] should_fail+0x230/0x240 [ 1033.234081][ T3954] __alloc_pages+0xf0/0x320 [ 1033.238600][ T3954] alloc_pages_vma+0x66d/0x7e0 [ 1033.243373][ T3954] ? __this_cpu_preempt_check+0xf/0x10 [ 1033.248839][ T3954] shmem_alloc_and_acct_page+0x219/0x580 [ 1033.254602][ T3954] shmem_getpage_gfp+0x300/0x16c0 [ 1033.259675][ T3954] shmem_write_begin+0x84/0x110 [ 1033.264595][ T3954] generic_perform_write+0x1d6/0x3f0 [ 1033.269896][ T3954] ? shmem_write_begin+0x110/0x110 [ 1033.275063][ T3954] __generic_file_write_iter+0xe3/0x280 [ 1033.280620][ T3954] ? generic_write_checks+0x256/0x290 [ 1033.285997][ T3954] generic_file_write_iter+0x75/0x130 [ 1033.291503][ T3954] vfs_write+0x71c/0x890 [ 1033.295761][ T3954] ksys_write+0xe8/0x1a0 [ 1033.300041][ T3954] __x64_sys_write+0x3e/0x50 [ 1033.304738][ T3954] do_syscall_64+0x2b/0x70 [ 1033.309157][ T3954] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1033.315040][ T3954] RIP: 0033:0x7f66d72200e9 [ 1033.319441][ T3954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1033.339130][ T3954] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1033.347526][ T3954] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1033.355490][ T3954] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1033.363524][ T3954] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1033.371538][ T3954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 20:03:55 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 3) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:55 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000380), 0x2e, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x9, 0x2, {"fa754164f2c41df2c03ca51b2de7d6ba"}, 0x7f, 0x6, 0x8001}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r3, 0x1, "b5ab16", "cd0b4aaa901f801cd6621e743dabc9cc3f5dd3eddad02a36944a8a9c12f2c4509546a097b45c7df8922ce47bfe0a1dff9d54329f91973734b49b52d3e6822c831ef69490aa13d3f4b9ef7968604da93cfdefd7ed05266baf208d6c6354573d402ac2b809ae20fe70a1d92b0af0737ef444afe304ed5ad38f08972ca3ea7fe35c4479e3d8eb091e3170c04046a091003b8062650e34d5fb12815aff6a7a15547926b174102296a4a6f472a5990f530064e8cf06ae5030c44b4763b1520ff35359e6d4ec5656446fd88f35f420306f5ccb5e295b8088e12febe7109e6aaeba59acbd708e3a6f81a74328575b2708069f886e5254a776e974919d076a9c443a06c7"}}, 0x110) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x4}, 0x10) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x8010, 0xffffffffffffffff, 0x100000000) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2d4601) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf, 0x12, r4, 0x9) 20:03:55 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000000), 0x1, {0xa, 0x4e21, 0x7, @private1, 0x1}, r1}}, 0x38) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) socket$inet_tcp(0x2, 0x1, 0x0) write$P9_RREADDIR(r0, 0x0, 0xffcb) io_uring_setup(0x1460, &(0x7f0000000000)={0x0, 0x77e0, 0x0, 0x1, 0x12}) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000000), 0x1, {0xa, 0x4e21, 0x7, @private1, 0x1}, r1}}, 0x38) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) [ 1033.379536][ T3954] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1033.387737][ T3954] [ 1033.408711][ T3994] FAULT_INJECTION: forcing a failure. [ 1033.408711][ T3994] name fail_page_alloc, interval 1, probability 0, space 0, times 0 20:03:55 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) socket$inet_tcp(0x2, 0x1, 0x0) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) io_uring_setup(0x1460, &(0x7f0000000000)={0x0, 0x77e0, 0x0, 0x1, 0x12}) 20:03:55 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:55 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000000), 0x1, {0xa, 0x4e21, 0x7, @private1, 0x1}, r1}}, 0x38) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) [ 1033.422167][ T3994] CPU: 0 PID: 3994 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1033.433152][ T3994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1033.443306][ T3994] Call Trace: [ 1033.446587][ T3994] [ 1033.449512][ T3994] dump_stack_lvl+0xd6/0x122 [ 1033.454149][ T3994] dump_stack+0x11/0x12 [ 1033.458316][ T3994] should_fail+0x230/0x240 [ 1033.462806][ T3994] __alloc_pages+0xf0/0x320 [ 1033.467319][ T3994] alloc_pages_vma+0x66d/0x7e0 [ 1033.472094][ T3994] ? __this_cpu_preempt_check+0xf/0x10 20:03:55 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000380), 0x2e, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x9, 0x2, {"fa754164f2c41df2c03ca51b2de7d6ba"}, 0x7f, 0x6, 0x8001}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r3, 0x1, "b5ab16", "cd0b4aaa901f801cd6621e743dabc9cc3f5dd3eddad02a36944a8a9c12f2c4509546a097b45c7df8922ce47bfe0a1dff9d54329f91973734b49b52d3e6822c831ef69490aa13d3f4b9ef7968604da93cfdefd7ed05266baf208d6c6354573d402ac2b809ae20fe70a1d92b0af0737ef444afe304ed5ad38f08972ca3ea7fe35c4479e3d8eb091e3170c04046a091003b8062650e34d5fb12815aff6a7a15547926b174102296a4a6f472a5990f530064e8cf06ae5030c44b4763b1520ff35359e6d4ec5656446fd88f35f420306f5ccb5e295b8088e12febe7109e6aaeba59acbd708e3a6f81a74328575b2708069f886e5254a776e974919d076a9c443a06c7"}}, 0x110) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x4}, 0x10) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x8010, 0xffffffffffffffff, 0x100000000) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2d4601) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf, 0x12, r4, 0x9) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000380), 0x2e, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x9, 0x2, {"fa754164f2c41df2c03ca51b2de7d6ba"}, 0x7f, 0x6, 0x8001}}}, 0x90) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x106, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r3, 0x1, "b5ab16", "cd0b4aaa901f801cd6621e743dabc9cc3f5dd3eddad02a36944a8a9c12f2c4509546a097b45c7df8922ce47bfe0a1dff9d54329f91973734b49b52d3e6822c831ef69490aa13d3f4b9ef7968604da93cfdefd7ed05266baf208d6c6354573d402ac2b809ae20fe70a1d92b0af0737ef444afe304ed5ad38f08972ca3ea7fe35c4479e3d8eb091e3170c04046a091003b8062650e34d5fb12815aff6a7a15547926b174102296a4a6f472a5990f530064e8cf06ae5030c44b4763b1520ff35359e6d4ec5656446fd88f35f420306f5ccb5e295b8088e12febe7109e6aaeba59acbd708e3a6f81a74328575b2708069f886e5254a776e974919d076a9c443a06c7"}}, 0x110) (async) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x4}, 0x10) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x8010, 0xffffffffffffffff, 0x100000000) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2d4601) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf, 0x12, r4, 0x9) (async) [ 1033.477657][ T3994] shmem_alloc_and_acct_page+0x219/0x580 [ 1033.483399][ T3994] shmem_getpage_gfp+0x300/0x16c0 [ 1033.488450][ T3994] shmem_write_begin+0x84/0x110 [ 1033.493370][ T3994] generic_perform_write+0x1d6/0x3f0 [ 1033.498699][ T3994] ? shmem_write_begin+0x110/0x110 [ 1033.503847][ T3994] __generic_file_write_iter+0xe3/0x280 [ 1033.509397][ T3994] ? generic_write_checks+0x256/0x290 [ 1033.514773][ T3994] generic_file_write_iter+0x75/0x130 [ 1033.520188][ T3994] vfs_write+0x71c/0x890 [ 1033.524518][ T3994] ksys_write+0xe8/0x1a0 [ 1033.528777][ T3994] __x64_sys_write+0x3e/0x50 [ 1033.533498][ T3994] do_syscall_64+0x2b/0x70 [ 1033.538028][ T3994] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1033.543927][ T3994] RIP: 0033:0x7f66d72200e9 [ 1033.548394][ T3994] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1033.568134][ T3994] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 20:03:56 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 4) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r2}}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000380), 0x2e, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x9, 0x2, {"fa754164f2c41df2c03ca51b2de7d6ba"}, 0x7f, 0x6, 0x8001}}}, 0x90) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r3, 0x1, "b5ab16", "cd0b4aaa901f801cd6621e743dabc9cc3f5dd3eddad02a36944a8a9c12f2c4509546a097b45c7df8922ce47bfe0a1dff9d54329f91973734b49b52d3e6822c831ef69490aa13d3f4b9ef7968604da93cfdefd7ed05266baf208d6c6354573d402ac2b809ae20fe70a1d92b0af0737ef444afe304ed5ad38f08972ca3ea7fe35c4479e3d8eb091e3170c04046a091003b8062650e34d5fb12815aff6a7a15547926b174102296a4a6f472a5990f530064e8cf06ae5030c44b4763b1520ff35359e6d4ec5656446fd88f35f420306f5ccb5e295b8088e12febe7109e6aaeba59acbd708e3a6f81a74328575b2708069f886e5254a776e974919d076a9c443a06c7"}}, 0x110) (async) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x4}, 0x10) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x8010, 0xffffffffffffffff, 0x100000000) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2d4601) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf, 0x12, r4, 0x9) [ 1033.576530][ T3994] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1033.584497][ T3994] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1033.592473][ T3994] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1033.600472][ T3994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1033.608443][ T3994] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1033.616544][ T3994] 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) socket$inet_tcp(0x2, 0x1, 0x0) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) io_uring_setup(0x1460, &(0x7f0000000000)={0x0, 0x77e0, 0x0, 0x1, 0x12}) 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) 20:03:56 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={r0, 0x1, r1, 0x3, 0x80000}) [ 1033.639859][ T4033] FAULT_INJECTION: forcing a failure. [ 1033.639859][ T4033] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1033.653051][ T4033] CPU: 0 PID: 4033 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1033.664126][ T4033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1033.674207][ T4033] Call Trace: [ 1033.677486][ T4033] [ 1033.680501][ T4033] dump_stack_lvl+0xd6/0x122 [ 1033.685157][ T4033] dump_stack+0x11/0x12 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) (async) [ 1033.689320][ T4033] should_fail+0x230/0x240 [ 1033.693746][ T4033] should_fail_usercopy+0x16/0x20 [ 1033.698781][ T4033] copy_page_from_iter_atomic+0x3de/0xb80 [ 1033.704509][ T4033] ? shmem_write_begin+0x84/0x110 [ 1033.709571][ T4033] generic_perform_write+0x21a/0x3f0 [ 1033.714961][ T4033] ? shmem_write_begin+0x110/0x110 [ 1033.720217][ T4033] __generic_file_write_iter+0xe3/0x280 [ 1033.725767][ T4033] ? generic_write_checks+0x256/0x290 [ 1033.731210][ T4033] generic_file_write_iter+0x75/0x130 [ 1033.736598][ T4033] vfs_write+0x71c/0x890 [ 1033.740988][ T4033] ksys_write+0xe8/0x1a0 [ 1033.745314][ T4033] __x64_sys_write+0x3e/0x50 [ 1033.749964][ T4033] do_syscall_64+0x2b/0x70 [ 1033.754438][ T4033] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1033.760327][ T4033] RIP: 0033:0x7f66d72200e9 [ 1033.764729][ T4033] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:56 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 5) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080)=0x1, r4, 0x0, 0x2, 0x4}}, 0x20) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000000)={0x4, 0x8, 0xfa00, {r1, 0x2}}, 0x10) 20:03:56 executing program 0: timer_create(0x1, 0x0, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{}, {0x77359400}}, 0x0) timer_create(0x3, &(0x7f0000000040)={0x0, 0x37}, &(0x7f0000000080)=0x0) timer_gettime(r0, &(0x7f00000004c0)) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:03:56 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={r0, 0x1, r1, 0x3, 0x80000}) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async, rerun: 32) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0}) (async, rerun: 32) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={r0, 0x1, r1, 0x3, 0x80000}) [ 1033.784436][ T4033] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1033.792842][ T4033] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1033.800800][ T4033] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1033.808780][ T4033] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1033.816827][ T4033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1033.824783][ T4033] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1033.832782][ T4033] [ 1033.874279][ T4071] FAULT_INJECTION: forcing a failure. [ 1033.874279][ T4071] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1033.887379][ T4071] CPU: 1 PID: 4071 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1033.898407][ T4071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1033.908488][ T4071] Call Trace: [ 1033.911791][ T4071] [ 1033.914722][ T4071] dump_stack_lvl+0xd6/0x122 [ 1033.919416][ T4071] dump_stack+0x11/0x12 20:03:56 executing program 0: timer_create(0x1, 0x0, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{}, {0x77359400}}, 0x0) (async) timer_create(0x3, &(0x7f0000000040)={0x0, 0x37}, &(0x7f0000000080)=0x0) timer_gettime(r0, &(0x7f00000004c0)) (async) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1033.923577][ T4071] should_fail+0x230/0x240 [ 1033.927999][ T4071] should_fail_usercopy+0x16/0x20 [ 1033.933027][ T4071] copy_page_from_iter_atomic+0x3de/0xb80 [ 1033.938728][ T4071] ? shmem_write_begin+0x84/0x110 [ 1033.943770][ T4071] generic_perform_write+0x21a/0x3f0 [ 1033.949042][ T4071] ? shmem_write_begin+0x110/0x110 [ 1033.954189][ T4071] __generic_file_write_iter+0xe3/0x280 [ 1033.959867][ T4071] ? generic_write_checks+0x256/0x290 [ 1033.965225][ T4071] generic_file_write_iter+0x75/0x130 [ 1033.970598][ T4071] vfs_write+0x71c/0x890 [ 1033.974922][ T4071] ksys_write+0xe8/0x1a0 [ 1033.979211][ T4071] __x64_sys_write+0x3e/0x50 [ 1033.983898][ T4071] do_syscall_64+0x2b/0x70 [ 1033.988367][ T4071] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1033.994431][ T4071] RIP: 0033:0x7f66d72200e9 [ 1033.998951][ T4071] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:56 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 6) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080)=0x1, r4, 0x0, 0x2, 0x4}}, 0x20) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000000)={0x4, 0x8, 0xfa00, {r1, 0x2}}, 0x10) 20:03:56 executing program 0: timer_create(0x1, 0x0, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{}, {0x77359400}}, 0x0) timer_create(0x3, &(0x7f0000000040)={0x0, 0x37}, &(0x7f0000000080)=0x0) timer_gettime(r0, &(0x7f00000004c0)) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, 0x0, 0xffcb) timer_create(0x1, 0x0, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000440)={{}, {0x77359400}}, 0x0) (async) timer_create(0x3, &(0x7f0000000040)={0x0, 0x37}, &(0x7f0000000080)) (async) timer_gettime(r0, &(0x7f00000004c0)) (async) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r1, 0x0, 0xffcb) (async) [ 1034.018728][ T4071] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1034.027208][ T4071] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1034.035207][ T4071] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1034.043157][ T4071] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1034.051183][ T4071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.059221][ T4071] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1034.067189][ T4071] 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080)=0x1, r4, 0x0, 0x2, 0x4}}, 0x20) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000000)={0x4, 0x8, 0xfa00, {r1, 0x2}}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r1}}, 0x18) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x2, 0x3}}, 0x20) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080)=0x1, r4, 0x0, 0x2, 0x4}}, 0x20) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000000)={0x4, 0x8, 0xfa00, {r1, 0x2}}, 0x10) (async) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8000) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000000, 0x2131, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x5, 0x4bcb, 0x1000) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1034.099698][ T4103] FAULT_INJECTION: forcing a failure. [ 1034.099698][ T4103] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1034.113055][ T4103] CPU: 1 PID: 4103 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1034.123998][ T4103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1034.134062][ T4103] Call Trace: [ 1034.137344][ T4103] [ 1034.140273][ T4103] dump_stack_lvl+0xd6/0x122 [ 1034.144907][ T4103] dump_stack+0x11/0x12 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfffffffffffffffc, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1034.149140][ T4103] should_fail+0x230/0x240 [ 1034.153640][ T4103] __alloc_pages+0xf0/0x320 [ 1034.158173][ T4103] alloc_pages_vma+0x66d/0x7e0 [ 1034.162950][ T4103] ? __this_cpu_preempt_check+0xf/0x10 [ 1034.168421][ T4103] shmem_alloc_and_acct_page+0x219/0x580 [ 1034.174146][ T4103] shmem_getpage_gfp+0x300/0x16c0 [ 1034.179360][ T4103] shmem_write_begin+0x84/0x110 [ 1034.184563][ T4103] generic_perform_write+0x1d6/0x3f0 [ 1034.189864][ T4103] ? shmem_write_begin+0x110/0x110 [ 1034.195120][ T4103] __generic_file_write_iter+0xe3/0x280 [ 1034.200841][ T4103] ? generic_write_checks+0x256/0x290 [ 1034.206304][ T4103] generic_file_write_iter+0x75/0x130 [ 1034.211691][ T4103] vfs_write+0x71c/0x890 [ 1034.215930][ T4103] ksys_write+0xe8/0x1a0 [ 1034.220241][ T4103] __x64_sys_write+0x3e/0x50 [ 1034.224826][ T4103] do_syscall_64+0x2b/0x70 [ 1034.229222][ T4103] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1034.235314][ T4103] RIP: 0033:0x7f66d72200e9 [ 1034.239731][ T4103] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1034.259379][ T4103] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1034.267770][ T4103] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1034.275733][ T4103] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1034.283690][ T4103] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1034.291656][ T4103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 20:03:56 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 7) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:56 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:56 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfffffffffffffffc, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:56 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) (async) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8000) (async, rerun: 32) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000000, 0x2131, 0xffffffffffffffff, 0x0) (async, rerun: 32) remap_file_pages(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x5, 0x4bcb, 0x1000) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 0: sendmsg$tipc(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="bf4bb7fb8f45fd28d197b4e4634a5876f3ce7559226fd814a776a14434f2cf13f5d5ef89118a56d629d882576f483d385506205db5375f37b4a75684", 0x3c}, {&(0x7f0000000040)="d292df0559cdc66774ecf5e89a02aa612ec5e7b541dfce1a6ed1fbfa0c83261449870a7197dd03762d8185ebf5f2968175eaa3a7a0bb1ddb4b177ea75670ac76cdfb8f7fa6129336aa03c81a1dbd", 0x4e}], 0x2, &(0x7f0000000100)="fa552e6c23272f71e44ddde74c36fc01b1661e6211777a8fc9bd14f3f8bd779e16d16dc3bfdb9a1494b9f7712e13001bd695638a9ce1a65ffb8f45c472614bab56458867604f667c6fa1560ae59fdf255c092564b3d3cfcc8d95e0fb6f5ac08a93574e86e6f890eb9947a3a919f77fe73be3bfa7fb4a10f7798ffa5cf037fc006d8be98863574e1d08d69d0123e7bb0a5677fc5d56b124a1006ff2d878396f6e2f75fd74c39f6abce32c11e54a38972a", 0xb0, 0x4008011}, 0x8000) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x4482) write$P9_RREADDIR(r0, 0x0, 0xffcb) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000200)='/dev/vcs#\x00', &(0x7f0000000240)='./file0\x00', 0xffffffffffffff9c) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1034.299612][ T4103] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1034.307569][ T4103] [ 1034.329234][ T4147] FAULT_INJECTION: forcing a failure. [ 1034.329234][ T4147] name fail_page_alloc, interval 1, probability 0, space 0, times 0 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 0: sendmsg$tipc(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="bf4bb7fb8f45fd28d197b4e4634a5876f3ce7559226fd814a776a14434f2cf13f5d5ef89118a56d629d882576f483d385506205db5375f37b4a75684", 0x3c}, {&(0x7f0000000040)="d292df0559cdc66774ecf5e89a02aa612ec5e7b541dfce1a6ed1fbfa0c83261449870a7197dd03762d8185ebf5f2968175eaa3a7a0bb1ddb4b177ea75670ac76cdfb8f7fa6129336aa03c81a1dbd", 0x4e}], 0x2, &(0x7f0000000100)="fa552e6c23272f71e44ddde74c36fc01b1661e6211777a8fc9bd14f3f8bd779e16d16dc3bfdb9a1494b9f7712e13001bd695638a9ce1a65ffb8f45c472614bab56458867604f667c6fa1560ae59fdf255c092564b3d3cfcc8d95e0fb6f5ac08a93574e86e6f890eb9947a3a919f77fe73be3bfa7fb4a10f7798ffa5cf037fc006d8be98863574e1d08d69d0123e7bb0a5677fc5d56b124a1006ff2d878396f6e2f75fd74c39f6abce32c11e54a38972a", 0xb0, 0x4008011}, 0x8000) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x4482) write$P9_RREADDIR(r0, 0x0, 0xffcb) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000200)='/dev/vcs#\x00', &(0x7f0000000240)='./file0\x00', 0xffffffffffffff9c) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="bf4bb7fb8f45fd28d197b4e4634a5876f3ce7559226fd814a776a14434f2cf13f5d5ef89118a56d629d882576f483d385506205db5375f37b4a75684", 0x3c}, {&(0x7f0000000040)="d292df0559cdc66774ecf5e89a02aa612ec5e7b541dfce1a6ed1fbfa0c83261449870a7197dd03762d8185ebf5f2968175eaa3a7a0bb1ddb4b177ea75670ac76cdfb8f7fa6129336aa03c81a1dbd", 0x4e}], 0x2, &(0x7f0000000100)="fa552e6c23272f71e44ddde74c36fc01b1661e6211777a8fc9bd14f3f8bd779e16d16dc3bfdb9a1494b9f7712e13001bd695638a9ce1a65ffb8f45c472614bab56458867604f667c6fa1560ae59fdf255c092564b3d3cfcc8d95e0fb6f5ac08a93574e86e6f890eb9947a3a919f77fe73be3bfa7fb4a10f7798ffa5cf037fc006d8be98863574e1d08d69d0123e7bb0a5677fc5d56b124a1006ff2d878396f6e2f75fd74c39f6abce32c11e54a38972a", 0xb0, 0x4008011}, 0x8000) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x4482) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000200)='/dev/vcs#\x00', &(0x7f0000000240)='./file0\x00', 0xffffffffffffff9c) (async) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:56 executing program 0: sendmsg$tipc(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="bf4bb7fb8f45fd28d197b4e4634a5876f3ce7559226fd814a776a14434f2cf13f5d5ef89118a56d629d882576f483d385506205db5375f37b4a75684", 0x3c}, {&(0x7f0000000040)="d292df0559cdc66774ecf5e89a02aa612ec5e7b541dfce1a6ed1fbfa0c83261449870a7197dd03762d8185ebf5f2968175eaa3a7a0bb1ddb4b177ea75670ac76cdfb8f7fa6129336aa03c81a1dbd", 0x4e}], 0x2, &(0x7f0000000100)="fa552e6c23272f71e44ddde74c36fc01b1661e6211777a8fc9bd14f3f8bd779e16d16dc3bfdb9a1494b9f7712e13001bd695638a9ce1a65ffb8f45c472614bab56458867604f667c6fa1560ae59fdf255c092564b3d3cfcc8d95e0fb6f5ac08a93574e86e6f890eb9947a3a919f77fe73be3bfa7fb4a10f7798ffa5cf037fc006d8be98863574e1d08d69d0123e7bb0a5677fc5d56b124a1006ff2d878396f6e2f75fd74c39f6abce32c11e54a38972a", 0xb0, 0x4008011}, 0x8000) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x4482) write$P9_RREADDIR(r0, 0x0, 0xffcb) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000200)='/dev/vcs#\x00', &(0x7f0000000240)='./file0\x00', 0xffffffffffffff9c) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="bf4bb7fb8f45fd28d197b4e4634a5876f3ce7559226fd814a776a14434f2cf13f5d5ef89118a56d629d882576f483d385506205db5375f37b4a75684", 0x3c}, {&(0x7f0000000040)="d292df0559cdc66774ecf5e89a02aa612ec5e7b541dfce1a6ed1fbfa0c83261449870a7197dd03762d8185ebf5f2968175eaa3a7a0bb1ddb4b177ea75670ac76cdfb8f7fa6129336aa03c81a1dbd", 0x4e}], 0x2, &(0x7f0000000100)="fa552e6c23272f71e44ddde74c36fc01b1661e6211777a8fc9bd14f3f8bd779e16d16dc3bfdb9a1494b9f7712e13001bd695638a9ce1a65ffb8f45c472614bab56458867604f667c6fa1560ae59fdf255c092564b3d3cfcc8d95e0fb6f5ac08a93574e86e6f890eb9947a3a919f77fe73be3bfa7fb4a10f7798ffa5cf037fc006d8be98863574e1d08d69d0123e7bb0a5677fc5d56b124a1006ff2d878396f6e2f75fd74c39f6abce32c11e54a38972a", 0xb0, 0x4008011}, 0x8000) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x4482) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000200)='/dev/vcs#\x00', &(0x7f0000000240)='./file0\x00', 0xffffffffffffff9c) (async) 20:03:56 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1034.342572][ T4147] CPU: 1 PID: 4147 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1034.353685][ T4147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1034.363739][ T4147] Call Trace: [ 1034.367017][ T4147] [ 1034.369946][ T4147] dump_stack_lvl+0xd6/0x122 [ 1034.374595][ T4147] dump_stack+0x11/0x12 [ 1034.378762][ T4147] should_fail+0x230/0x240 [ 1034.383200][ T4147] __alloc_pages+0xf0/0x320 [ 1034.387749][ T4147] alloc_pages_vma+0x66d/0x7e0 [ 1034.392608][ T4147] ? __this_cpu_preempt_check+0xf/0x10 [ 1034.398084][ T4147] shmem_alloc_and_acct_page+0x219/0x580 [ 1034.403730][ T4147] shmem_getpage_gfp+0x300/0x16c0 [ 1034.408840][ T4147] shmem_write_begin+0x84/0x110 [ 1034.413758][ T4147] generic_perform_write+0x1d6/0x3f0 [ 1034.419072][ T4147] ? shmem_write_begin+0x110/0x110 [ 1034.424200][ T4147] __generic_file_write_iter+0xe3/0x280 [ 1034.429754][ T4147] ? generic_write_checks+0x256/0x290 [ 1034.435194][ T4147] generic_file_write_iter+0x75/0x130 [ 1034.440575][ T4147] vfs_write+0x71c/0x890 [ 1034.444837][ T4147] ksys_write+0xe8/0x1a0 [ 1034.449159][ T4147] __x64_sys_write+0x3e/0x50 [ 1034.453796][ T4147] do_syscall_64+0x2b/0x70 [ 1034.458220][ T4147] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1034.464169][ T4147] RIP: 0033:0x7f66d72200e9 [ 1034.468748][ T4147] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1034.488486][ T4147] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 20:03:57 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 8) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfffffffffffffffc, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfffffffffffffffc, &(0x7f0000000140), 0x13f, 0xa}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r0, 0x0, 0x0) (async, rerun: 64) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8000) (rerun: 64) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000000, 0x2131, 0xffffffffffffffff, 0x0) (async) remap_file_pages(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x5, 0x4bcb, 0x1000) 20:03:57 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, r1, 0x300, 0x70bd2c, 0x25dfdc01, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = fsmount(r2, 0x1, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) write$P9_RREADDIR(r3, 0x0, 0xfff5) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1034.496886][ T4147] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1034.504845][ T4147] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1034.512842][ T4147] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1034.520800][ T4147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.528765][ T4147] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1034.536807][ T4147] 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socketpair(0x2a, 0x80000, 0x10001, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/180, 0xb4, 0x0, &(0x7f00000000c0)=""/77, 0x4d}, &(0x7f0000000180)=0x40) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB="31230000b17f08ac59af5861c3f5102de10a760072b8278e492315e431ee2f34ef994efea62249ddb72d4fd22ee60bcf18545f32bb1d1d146c4fa3b6968c81c323b13811efb41eae2975f6bfd7e196872b5fabde4e762435b8a47a2dd6dee87c2631fc0000000000000000b09c7830b09cce3f061c0e91eefd5d202cfa2595b706119ec7749fdcb8cedf55570b651abc3c3120ea0a5ba848146df8a2b6766985df75b21adeb8954d99f2ee17e6c13b1545cca704b8e69d7c8e082ee2de7bd7e80d1585d84a93e28f9b777b8016b1a33e67094a31d0a0c3208d3a51e017c6b29e9128f3f5e7287660152079d27a761377d76ac2b69d59c6006af204dfd3ad51b711a6cf9535ffec83301132afa3045d751982fd76d84db5152731163c0c", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x54, r3, 0x8, 0x70bd25, 0x5, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa7f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20000800) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockopt$TIPC_IMPORTANCE(r4, 0x10f, 0x7f, &(0x7f0000000200), &(0x7f0000000240)=0x4) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:57 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, r1, 0x300, 0x70bd2c, 0x25dfdc01, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r3 = fsmount(r2, 0x1, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) write$P9_RREADDIR(r3, 0x0, 0xfff5) [ 1034.578268][ T4192] FAULT_INJECTION: forcing a failure. [ 1034.578268][ T4192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1034.591483][ T4192] CPU: 1 PID: 4192 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1034.602433][ T4192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1034.612602][ T4192] Call Trace: [ 1034.615873][ T4192] [ 1034.618802][ T4192] dump_stack_lvl+0xd6/0x122 [ 1034.623397][ T4192] dump_stack+0x11/0x12 [ 1034.627560][ T4192] should_fail+0x230/0x240 [ 1034.632004][ T4192] should_fail_usercopy+0x16/0x20 [ 1034.637040][ T4192] copy_page_from_iter_atomic+0x3de/0xb80 [ 1034.642775][ T4192] ? shmem_write_begin+0x84/0x110 [ 1034.647909][ T4192] generic_perform_write+0x21a/0x3f0 [ 1034.653201][ T4192] ? shmem_write_begin+0x110/0x110 [ 1034.658411][ T4192] __generic_file_write_iter+0xe3/0x280 [ 1034.663959][ T4192] ? generic_write_checks+0x256/0x290 [ 1034.669332][ T4192] generic_file_write_iter+0x75/0x130 [ 1034.674803][ T4192] vfs_write+0x71c/0x890 [ 1034.679130][ T4192] ksys_write+0xe8/0x1a0 [ 1034.683413][ T4192] __x64_sys_write+0x3e/0x50 [ 1034.688051][ T4192] do_syscall_64+0x2b/0x70 [ 1034.692450][ T4192] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1034.698323][ T4192] RIP: 0033:0x7f66d72200e9 [ 1034.702717][ T4192] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:57 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 9) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 0: syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, r1, 0x300, 0x70bd2c, 0x25dfdc01, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) r3 = fsmount(r2, 0x1, 0x0) (rerun: 64) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) write$P9_RREADDIR(r3, 0x0, 0xfff5) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) socketpair(0x2a, 0x80000, 0x10001, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/180, 0xb4, 0x0, &(0x7f00000000c0)=""/77, 0x4d}, &(0x7f0000000180)=0x40) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB="31230000b17f08ac59af5861c3f5102de10a760072b8278e492315e431ee2f34ef994efea62249ddb72d4fd22ee60bcf18545f32bb1d1d146c4fa3b6968c81c323b13811efb41eae2975f6bfd7e196872b5fabde4e762435b8a47a2dd6dee87c2631fc0000000000000000b09c7830b09cce3f061c0e91eefd5d202cfa2595b706119ec7749fdcb8cedf55570b651abc3c3120ea0a5ba848146df8a2b6766985df75b21adeb8954d99f2ee17e6c13b1545cca704b8e69d7c8e082ee2de7bd7e80d1585d84a93e28f9b777b8016b1a33e67094a31d0a0c3208d3a51e017c6b29e9128f3f5e7287660152079d27a761377d76ac2b69d59c6006af204dfd3ad51b711a6cf9535ffec83301132afa3045d751982fd76d84db5152731163c0c", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x54, r3, 0x8, 0x70bd25, 0x5, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa7f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20000800) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 32) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) getsockopt$TIPC_IMPORTANCE(r4, 0x10f, 0x7f, &(0x7f0000000200), &(0x7f0000000240)=0x4) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1034.722492][ T4192] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1034.730883][ T4192] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1034.739027][ T4192] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1034.746974][ T4192] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1034.754929][ T4192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.762933][ T4192] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1034.770891][ T4192] 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socketpair(0x2a, 0x80000, 0x10001, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/180, 0xb4, 0x0, &(0x7f00000000c0)=""/77, 0x4d}, &(0x7f0000000180)=0x40) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB="31230000b17f08ac59af5861c3f5102de10a760072b8278e492315e431ee2f34ef994efea62249ddb72d4fd22ee60bcf18545f32bb1d1d146c4fa3b6968c81c323b13811efb41eae2975f6bfd7e196872b5fabde4e762435b8a47a2dd6dee87c2631fc0000000000000000b09c7830b09cce3f061c0e91eefd5d202cfa2595b706119ec7749fdcb8cedf55570b651abc3c3120ea0a5ba848146df8a2b6766985df75b21adeb8954d99f2ee17e6c13b1545cca704b8e69d7c8e082ee2de7bd7e80d1585d84a93e28f9b777b8016b1a33e67094a31d0a0c3208d3a51e017c6b29e9128f3f5e7287660152079d27a761377d76ac2b69d59c6006af204dfd3ad51b711a6cf9535ffec83301132afa3045d751982fd76d84db5152731163c0c", @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x54, r3, 0x8, 0x70bd25, 0x5, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa7f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20000800) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockopt$TIPC_IMPORTANCE(r4, 0x10f, 0x7f, &(0x7f0000000200), &(0x7f0000000240)=0x4) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r2, 0x2}}, 0x18) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x8000, 0x539501) write$P9_RREADDIR(r0, 0x0, 0xffcb) syz_open_dev$usbmon(&(0x7f0000000000), 0xfffffffffffff33e, 0x20180) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1034.823872][ T4230] FAULT_INJECTION: forcing a failure. [ 1034.823872][ T4230] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1034.837005][ T4230] CPU: 1 PID: 4230 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1034.847998][ T4230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1034.858096][ T4230] Call Trace: [ 1034.861370][ T4230] [ 1034.864298][ T4230] dump_stack_lvl+0xd6/0x122 [ 1034.869029][ T4230] dump_stack+0x11/0x12 [ 1034.873195][ T4230] should_fail+0x230/0x240 [ 1034.877614][ T4230] should_fail_usercopy+0x16/0x20 [ 1034.882721][ T4230] copy_page_from_iter_atomic+0x3de/0xb80 [ 1034.888491][ T4230] ? shmem_write_begin+0x84/0x110 [ 1034.893511][ T4230] generic_perform_write+0x21a/0x3f0 [ 1034.898819][ T4230] ? shmem_write_begin+0x110/0x110 [ 1034.903929][ T4230] __generic_file_write_iter+0xe3/0x280 [ 1034.909449][ T4230] ? generic_write_checks+0x256/0x290 [ 1034.914805][ T4230] generic_file_write_iter+0x75/0x130 [ 1034.920156][ T4230] vfs_write+0x71c/0x890 [ 1034.924414][ T4230] ksys_write+0xe8/0x1a0 [ 1034.928756][ T4230] __x64_sys_write+0x3e/0x50 [ 1034.933324][ T4230] do_syscall_64+0x2b/0x70 [ 1034.937725][ T4230] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1034.943665][ T4230] RIP: 0033:0x7f66d72200e9 [ 1034.948067][ T4230] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:57 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:57 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x8000, 0x539501) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) syz_open_dev$usbmon(&(0x7f0000000000), 0xfffffffffffff33e, 0x20180) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x80) write$RDMA_USER_CM_CMD_ACCEPT(r3, &(0x7f00000005c0)={0x8, 0x120, 0xfa00, {0x2, {0x80000004, 0x401, "d5777000a08f8e592d685867d9c46fa56137b20377d97d645ab9c653c2a8451ad0509ea476b63dd5bf440becb376a9ebec732de237c2fcbbbc211edfdfbd0a6aec714bb3ab49dc3b040b9772eb73f4457fe636b06fea10a43689012831a6b433fbfb98268b53b74dfa43f6dfa8159ab5274786acc18b519d53c3fce707939d397c48589a442eb01709396d969ba9db5d0c523834e3ecc94b229c32ae2c584f8a62e8338b83e3a5874945821a92a05355cb67c3b77000ff836c8bf8e87aa1bb1e7cab12b253f334f5c3d671a0c9663d9f60b63d91733473b1660fc5b38167d0230ec941f83b2f47337327964bcc9f97c405c0bd0b2f7f14283eadeabdd478a49a", 0x31, 0xe3, 0x7f, 0x36, 0x7a, 0x6, 0x2, 0x1}, r2}}, 0x128) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 3: socket$xdp(0x2c, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd, 0x2131, r0, 0x0) 20:03:57 executing program 3: socket$xdp(0x2c, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd, 0x2131, r0, 0x0) socket$xdp(0x2c, 0x3, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd, 0x2131, r0, 0x0) (async) [ 1034.967713][ T4230] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1034.976171][ T4230] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1034.984121][ T4230] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1034.992125][ T4230] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1035.000089][ T4230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1035.008056][ T4230] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1035.016097][ T4230] 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x8000, 0x539501) write$P9_RREADDIR(r0, 0x0, 0xffcb) syz_open_dev$usbmon(&(0x7f0000000000), 0xfffffffffffff33e, 0x20180) syz_open_dev$vcsn(&(0x7f0000000580), 0x8000, 0x539501) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) syz_open_dev$usbmon(&(0x7f0000000000), 0xfffffffffffff33e, 0x20180) (async) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 3: socket$xdp(0x2c, 0x3, 0x0) (async) r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd, 0x2131, r0, 0x0) [ 1035.044438][ T4262] FAULT_INJECTION: forcing a failure. [ 1035.044438][ T4262] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1035.057715][ T4262] CPU: 1 PID: 4262 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1035.068715][ T4262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1035.078817][ T4262] Call Trace: [ 1035.082093][ T4262] [ 1035.085023][ T4262] dump_stack_lvl+0xd6/0x122 [ 1035.089633][ T4262] dump_stack+0x11/0x12 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1035.093792][ T4262] should_fail+0x230/0x240 [ 1035.098253][ T4262] __alloc_pages+0xf0/0x320 [ 1035.102811][ T4262] alloc_pages_vma+0x66d/0x7e0 [ 1035.107633][ T4262] ? __this_cpu_preempt_check+0xf/0x10 [ 1035.113097][ T4262] shmem_alloc_and_acct_page+0x219/0x580 [ 1035.118768][ T4262] shmem_getpage_gfp+0x300/0x16c0 [ 1035.123889][ T4262] shmem_write_begin+0x84/0x110 [ 1035.128749][ T4262] generic_perform_write+0x1d6/0x3f0 [ 1035.134038][ T4262] ? shmem_write_begin+0x110/0x110 [ 1035.139155][ T4262] __generic_file_write_iter+0xe3/0x280 [ 1035.144690][ T4262] ? generic_write_checks+0x256/0x290 [ 1035.150047][ T4262] generic_file_write_iter+0x75/0x130 [ 1035.155395][ T4262] vfs_write+0x71c/0x890 [ 1035.159642][ T4262] ksys_write+0xe8/0x1a0 [ 1035.163865][ T4262] __x64_sys_write+0x3e/0x50 [ 1035.168452][ T4262] do_syscall_64+0x2b/0x70 [ 1035.172871][ T4262] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1035.178812][ T4262] RIP: 0033:0x7f66d72200e9 [ 1035.183333][ T4262] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1035.203130][ T4262] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1035.211630][ T4262] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1035.219585][ T4262] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1035.227566][ T4262] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1035.235588][ T4262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 20:03:57 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 11) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x6f26, &(0x7f0000000100)={0x0, 0xeac, 0x1, 0x3, 0x2e5}, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={0x0, 0x1, r0, 0x0, 0x80000}) r1 = syz_io_uring_setup(0xf8e, &(0x7f0000000000)={0x0, 0xa14d, 0x1, 0x0, 0x16c}, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff5000/0xb000)=nil, 0xb000, 0x100000f, 0x8010, r1, 0x8000000) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x80) write$RDMA_USER_CM_CMD_ACCEPT(r3, &(0x7f00000005c0)={0x8, 0x120, 0xfa00, {0x2, {0x80000004, 0x401, "d5777000a08f8e592d685867d9c46fa56137b20377d97d645ab9c653c2a8451ad0509ea476b63dd5bf440becb376a9ebec732de237c2fcbbbc211edfdfbd0a6aec714bb3ab49dc3b040b9772eb73f4457fe636b06fea10a43689012831a6b433fbfb98268b53b74dfa43f6dfa8159ab5274786acc18b519d53c3fce707939d397c48589a442eb01709396d969ba9db5d0c523834e3ecc94b229c32ae2c584f8a62e8338b83e3a5874945821a92a05355cb67c3b77000ff836c8bf8e87aa1bb1e7cab12b253f334f5c3d671a0c9663d9f60b63d91733473b1660fc5b38167d0230ec941f83b2f47337327964bcc9f97c405c0bd0b2f7f14283eadeabdd478a49a", 0x31, 0xe3, 0x7f, 0x36, 0x7a, 0x6, 0x2, 0x1}, r2}}, 0x128) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) fsmount(0xffffffffffffffff, 0x0, 0x80) (async) write$RDMA_USER_CM_CMD_ACCEPT(r3, &(0x7f00000005c0)={0x8, 0x120, 0xfa00, {0x2, {0x80000004, 0x401, "d5777000a08f8e592d685867d9c46fa56137b20377d97d645ab9c653c2a8451ad0509ea476b63dd5bf440becb376a9ebec732de237c2fcbbbc211edfdfbd0a6aec714bb3ab49dc3b040b9772eb73f4457fe636b06fea10a43689012831a6b433fbfb98268b53b74dfa43f6dfa8159ab5274786acc18b519d53c3fce707939d397c48589a442eb01709396d969ba9db5d0c523834e3ecc94b229c32ae2c584f8a62e8338b83e3a5874945821a92a05355cb67c3b77000ff836c8bf8e87aa1bb1e7cab12b253f334f5c3d671a0c9663d9f60b63d91733473b1660fc5b38167d0230ec941f83b2f47337327964bcc9f97c405c0bd0b2f7f14283eadeabdd478a49a", 0x31, 0xe3, 0x7f, 0x36, 0x7a, 0x6, 0x2, 0x1}, r2}}, 0x128) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) (async) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1035.243536][ T4262] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1035.251535][ T4262] [ 1035.273842][ T4291] FAULT_INJECTION: forcing a failure. [ 1035.273842][ T4291] name fail_page_alloc, interval 1, probability 0, space 0, times 0 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) r0 = syz_io_uring_setup(0x6f26, &(0x7f0000000100)={0x0, 0xeac, 0x1, 0x3, 0x2e5}, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={0x0, 0x1, r0, 0x0, 0x80000}) r1 = syz_io_uring_setup(0xf8e, &(0x7f0000000000)={0x0, 0xa14d, 0x1, 0x0, 0x16c}, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff5000/0xb000)=nil, 0xb000, 0x100000f, 0x8010, r1, 0x8000000) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x6f26, &(0x7f0000000100)={0x0, 0xeac, 0x1, 0x3, 0x2e5}, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={0x0, 0x1, r0, 0x0, 0x80000}) r1 = syz_io_uring_setup(0xf8e, &(0x7f0000000000)={0x0, 0xa14d, 0x1, 0x0, 0x16c}, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff5000/0xb000)=nil, 0xb000, 0x100000f, 0x8010, r1, 0x8000000) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x6f26, &(0x7f0000000100)={0x0, 0xeac, 0x1, 0x3, 0x2e5}, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000200)={0x0, 0x1, r0, 0x0, 0x80000}) (async) syz_io_uring_setup(0xf8e, &(0x7f0000000000)={0x0, 0xa14d, 0x1, 0x0, 0x16c}, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff5000/0xb000)=nil, 0xb000, 0x100000f, 0x8010, r1, 0x8000000) (async) [ 1035.287107][ T4291] CPU: 1 PID: 4291 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1035.298063][ T4291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1035.308120][ T4291] Call Trace: [ 1035.311400][ T4291] [ 1035.314328][ T4291] dump_stack_lvl+0xd6/0x122 [ 1035.318930][ T4291] dump_stack+0x11/0x12 [ 1035.323094][ T4291] should_fail+0x230/0x240 [ 1035.327516][ T4291] __alloc_pages+0xf0/0x320 [ 1035.332123][ T4291] alloc_pages_vma+0x66d/0x7e0 [ 1035.336982][ T4291] ? __this_cpu_preempt_check+0xf/0x10 [ 1035.342490][ T4291] shmem_alloc_and_acct_page+0x219/0x580 [ 1035.348246][ T4291] shmem_getpage_gfp+0x300/0x16c0 [ 1035.353280][ T4291] shmem_write_begin+0x84/0x110 [ 1035.358139][ T4291] generic_perform_write+0x1d6/0x3f0 [ 1035.363551][ T4291] ? shmem_write_begin+0x110/0x110 [ 1035.368792][ T4291] __generic_file_write_iter+0xe3/0x280 [ 1035.374340][ T4291] ? generic_write_checks+0x256/0x290 [ 1035.379800][ T4291] generic_file_write_iter+0x75/0x130 [ 1035.385204][ T4291] vfs_write+0x71c/0x890 [ 1035.389596][ T4291] ksys_write+0xe8/0x1a0 [ 1035.393895][ T4291] __x64_sys_write+0x3e/0x50 [ 1035.398662][ T4291] do_syscall_64+0x2b/0x70 [ 1035.403085][ T4291] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1035.408959][ T4291] RIP: 0033:0x7f66d72200e9 [ 1035.413407][ T4291] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1035.433015][ T4291] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 20:03:57 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 12) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) r3 = fsmount(0xffffffffffffffff, 0x0, 0x80) write$RDMA_USER_CM_CMD_ACCEPT(r3, &(0x7f00000005c0)={0x8, 0x120, 0xfa00, {0x2, {0x80000004, 0x401, "d5777000a08f8e592d685867d9c46fa56137b20377d97d645ab9c653c2a8451ad0509ea476b63dd5bf440becb376a9ebec732de237c2fcbbbc211edfdfbd0a6aec714bb3ab49dc3b040b9772eb73f4457fe636b06fea10a43689012831a6b433fbfb98268b53b74dfa43f6dfa8159ab5274786acc18b519d53c3fce707939d397c48589a442eb01709396d969ba9db5d0c523834e3ecc94b229c32ae2c584f8a62e8338b83e3a5874945821a92a05355cb67c3b77000ff836c8bf8e87aa1bb1e7cab12b253f334f5c3d671a0c9663d9f60b63d91733473b1660fc5b38167d0230ec941f83b2f47337327964bcc9f97c405c0bd0b2f7f14283eadeabdd478a49a", 0x31, 0xe3, 0x7f, 0x36, 0x7a, 0x6, 0x2, 0x1}, r2}}, 0x128) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r5}}, 0xc) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r5}}, 0x18) 20:03:57 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:57 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x12, 0x10}, 0x18) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:57 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) 20:03:57 executing program 0: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) 20:03:57 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000), 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1035.441433][ T4291] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1035.449438][ T4291] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1035.457439][ T4291] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1035.465399][ T4291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1035.473359][ T4291] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1035.481330][ T4291] 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 0: fsmount(0xffffffffffffffff, 0x1, 0x80) r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r0, 0x9, 0x80000}) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)=',{\x00', &(0x7f00000000c0)='debugfs\x00', 0x0) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x12, 0x10}, 0x18) [ 1035.536317][ T4333] FAULT_INJECTION: forcing a failure. [ 1035.536317][ T4333] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1035.549621][ T4333] CPU: 0 PID: 4333 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1035.560584][ T4333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1035.570647][ T4333] Call Trace: [ 1035.573919][ T4333] [ 1035.576897][ T4333] dump_stack_lvl+0xd6/0x122 [ 1035.581495][ T4333] dump_stack+0x11/0x12 [ 1035.585659][ T4333] should_fail+0x230/0x240 [ 1035.590202][ T4333] should_fail_usercopy+0x16/0x20 [ 1035.595268][ T4333] copy_page_from_iter_atomic+0x3de/0xb80 [ 1035.600978][ T4333] ? shmem_write_begin+0x84/0x110 [ 1035.606064][ T4333] generic_perform_write+0x21a/0x3f0 [ 1035.611341][ T4333] ? shmem_write_begin+0x110/0x110 [ 1035.616479][ T4333] __generic_file_write_iter+0xe3/0x280 [ 1035.622243][ T4333] ? generic_write_checks+0x256/0x290 [ 1035.627599][ T4333] generic_file_write_iter+0x75/0x130 [ 1035.632966][ T4333] vfs_write+0x71c/0x890 [ 1035.637393][ T4333] ksys_write+0xe8/0x1a0 [ 1035.641705][ T4333] __x64_sys_write+0x3e/0x50 [ 1035.646281][ T4333] do_syscall_64+0x2b/0x70 [ 1035.650733][ T4333] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1035.656649][ T4333] RIP: 0033:0x7f66d72200e9 [ 1035.661046][ T4333] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:58 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 13) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:58 executing program 0: fsmount(0xffffffffffffffff, 0x1, 0x80) r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r0, 0x9, 0x80000}) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)=',{\x00', &(0x7f00000000c0)='debugfs\x00', 0x0) (rerun: 32) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x12, 0x10}, 0x18) 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000), 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000), 0x2, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x80, 0x0, 0x0, 0x0, @in={0x2, 0x4ea0, @loopback}, @ib={0x1b, 0xfffa, 0x80, {"687890651de5fe85d95a4ba220f5ab37"}, 0x4000008, 0x2, 0x8000}}}, 0x118) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1035.680658][ T4333] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1035.689099][ T4333] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1035.697054][ T4333] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1035.705005][ T4333] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1035.712956][ T4333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1035.720907][ T4333] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1035.728870][ T4333] 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000), 0x2, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) [ 1035.780032][ T4372] FAULT_INJECTION: forcing a failure. [ 1035.780032][ T4372] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1035.793288][ T4372] CPU: 0 PID: 4372 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1035.804370][ T4372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1035.814440][ T4372] Call Trace: [ 1035.817719][ T4372] [ 1035.820643][ T4372] dump_stack_lvl+0xd6/0x122 [ 1035.825355][ T4372] dump_stack+0x11/0x12 20:03:58 executing program 0: fsmount(0xffffffffffffffff, 0x1, 0x80) r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r0, 0x9, 0x80000}) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)=',{\x00', &(0x7f00000000c0)='debugfs\x00', 0x0) fsmount(0xffffffffffffffff, 0x1, 0x80) (async) fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r0, 0x9, 0x80000}) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)=',{\x00', &(0x7f00000000c0)='debugfs\x00', 0x0) (async) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x80, 0x0, 0x0, 0x0, @in={0x2, 0x4ea0, @loopback}, @ib={0x1b, 0xfffa, 0x80, {"687890651de5fe85d95a4ba220f5ab37"}, 0x4000008, 0x2, 0x8000}}}, 0x118) [ 1035.829517][ T4372] should_fail+0x230/0x240 [ 1035.833992][ T4372] should_fail_usercopy+0x16/0x20 [ 1035.839025][ T4372] copy_page_from_iter_atomic+0x3de/0xb80 [ 1035.844760][ T4372] ? shmem_write_begin+0x84/0x110 [ 1035.849847][ T4372] generic_perform_write+0x21a/0x3f0 [ 1035.855117][ T4372] ? shmem_write_begin+0x110/0x110 [ 1035.860251][ T4372] __generic_file_write_iter+0xe3/0x280 [ 1035.865925][ T4372] ? generic_write_checks+0x256/0x290 [ 1035.871283][ T4372] generic_file_write_iter+0x75/0x130 [ 1035.876683][ T4372] vfs_write+0x71c/0x890 [ 1035.880914][ T4372] ksys_write+0xe8/0x1a0 [ 1035.885209][ T4372] __x64_sys_write+0x3e/0x50 [ 1035.889872][ T4372] do_syscall_64+0x2b/0x70 [ 1035.894356][ T4372] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1035.900381][ T4372] RIP: 0033:0x7f66d72200e9 [ 1035.904783][ T4372] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:58 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 14) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:58 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = fsopen(&(0x7f0000000100)='anon_inodefs\x00', 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000140)='\x00', 0x0, r2) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) r4 = io_uring_setup(0x4c4, &(0x7f0000000000)={0x0, 0xd8ff, 0x8, 0x0, 0x1fb, 0x0, r3}) r5 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r6) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0xa, 0x0, r6) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0x4, {0x10001, 0x81, "9c922469e746c2187370c0553b2fd9a314190b5e50a8f73f3f79b39de80392d9aff542c8c6d8bf940d2ad2cb900f776e4cb7cb6b00c8b82ba424a329d71afdeff7cdabab612320968a01e341b9d472d796cd5374d528b8bcf2b2e7767e0ec7aecc7ae66cb2167b5bd2cc7547e41234f41c5cae01055d3dc4f4ca8ecf7516192fff91b3f8a48b467345e2f55eb22ef2ca98c30a2bda0546b680c7d58e21413bc4286a3090e3dfcdaf2656f4a5d70f2921d302edff4c9f9bd7a679a9d4833a7c789ad1aa351ff970fcf6ed976527de55c17b5f7c8fc4e8420464d3deabb8d47c7945928eafec0ced1d1793c95152797c833ca58391bb3e2fa3af4445da7b8fd8c3", 0x1f, 0xce, 0x9, 0x6, 0x3f, 0xfb, 0x20, 0x1}, r2}}, 0x128) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r2, 0x80000000}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x0, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async, rerun: 64) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (rerun: 64) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x80, 0x0, 0x0, 0x0, @in={0x2, 0x4ea0, @loopback}, @ib={0x1b, 0xfffa, 0x80, {"687890651de5fe85d95a4ba220f5ab37"}, 0x4000008, 0x2, 0x8000}}}, 0x118) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1035.924401][ T4372] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1035.932871][ T4372] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1035.940825][ T4372] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1035.948777][ T4372] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1035.956726][ T4372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1035.964727][ T4372] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1035.972776][ T4372] 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0x4, {0x10001, 0x81, "9c922469e746c2187370c0553b2fd9a314190b5e50a8f73f3f79b39de80392d9aff542c8c6d8bf940d2ad2cb900f776e4cb7cb6b00c8b82ba424a329d71afdeff7cdabab612320968a01e341b9d472d796cd5374d528b8bcf2b2e7767e0ec7aecc7ae66cb2167b5bd2cc7547e41234f41c5cae01055d3dc4f4ca8ecf7516192fff91b3f8a48b467345e2f55eb22ef2ca98c30a2bda0546b680c7d58e21413bc4286a3090e3dfcdaf2656f4a5d70f2921d302edff4c9f9bd7a679a9d4833a7c789ad1aa351ff970fcf6ed976527de55c17b5f7c8fc4e8420464d3deabb8d47c7945928eafec0ced1d1793c95152797c833ca58391bb3e2fa3af4445da7b8fd8c3", 0x1f, 0xce, 0x9, 0x6, 0x3f, 0xfb, 0x20, 0x1}, r2}}, 0x128) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r2, 0x80000000}}, 0x18) (async, rerun: 32) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x4}}, 0x20) (async, rerun: 64) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x0, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (rerun: 64) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 3: fsopen(&(0x7f0000000000)='tmpfs\x00', 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000140)='\x00\xd4\xdb\x9f]\x13`\x06\xf44\x98\x8f\x8c\x8a\xf6\xf4\xd4\xf1\x80\xd2{\xechc\x88\xd93\x91\xee\x9ec\xc5\xc0\x04x\xb9\xfd\x8d\xadU%Q\xfc\xe4)\xf1\x8c\xf1\x97\r\xd0\x85\x1a\xf8\x85\xe9\x00\xda\xf5D\x9d;\xbb\xcaE\xc7\x17*\xd2S\x1c]\x1e\xca;\x91\xa5\xbe\x1b\xf9R\xa1C\x00\tQ\xee\xf3\xb7\xe5\xdb\\T;\xd6GdT&\x9f\xdad{\xaa]\xd5\x01\x98\xb6\xa4\x17\x182\xf5}\xf8h\t\xee\xcbR\xfe!\xf8Tg\xfa\x0f\xba1\xbb\x82\xb9uc\xe2\xa8\x9a\x93\xbc\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000040)="6a12494aa44a3dfcbe8122f5fca7d7d939b97c63cc9986b1fc78218c7dfe127fe993c0df1edc899d84f61202d27007893e3b06ea7c55104146b29d9c6b374d5fda4ec996434ee56139a3b28189d2fe3043e65e67b7de14e4ce729f3a19873f8bd01221e0a2e69f58cbc16dc38513646f3bfe8a00fa6a93b317a5060240a1512b5fffbe433775bd18320ecbc6cfe8ada3412f8cbebefb97dc87465721e71ae1d2e0e5daa1356f47869262b67628a2beb0cf792c48ed73d2ba7d02b93c3d9d4aa5a23b06d4043d706c35363ad9d3ea78fe5fdbbf8acba837bb05a05415645281681fa69b2ada41738c1f3429", 0xeb) [ 1035.994993][ T4406] FAULT_INJECTION: forcing a failure. [ 1035.994993][ T4406] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1036.008238][ T4406] CPU: 0 PID: 4406 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1036.019226][ T4406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.029289][ T4406] Call Trace: [ 1036.032567][ T4406] [ 1036.035502][ T4406] dump_stack_lvl+0xd6/0x122 [ 1036.040104][ T4406] dump_stack+0x11/0x12 20:03:58 executing program 3: fsopen(&(0x7f0000000000)='tmpfs\x00', 0x0) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000140)='\x00\xd4\xdb\x9f]\x13`\x06\xf44\x98\x8f\x8c\x8a\xf6\xf4\xd4\xf1\x80\xd2{\xechc\x88\xd93\x91\xee\x9ec\xc5\xc0\x04x\xb9\xfd\x8d\xadU%Q\xfc\xe4)\xf1\x8c\xf1\x97\r\xd0\x85\x1a\xf8\x85\xe9\x00\xda\xf5D\x9d;\xbb\xcaE\xc7\x17*\xd2S\x1c]\x1e\xca;\x91\xa5\xbe\x1b\xf9R\xa1C\x00\tQ\xee\xf3\xb7\xe5\xdb\\T;\xd6GdT&\x9f\xdad{\xaa]\xd5\x01\x98\xb6\xa4\x17\x182\xf5}\xf8h\t\xee\xcbR\xfe!\xf8Tg\xfa\x0f\xba1\xbb\x82\xb9uc\xe2\xa8\x9a\x93\xbc\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000040)="6a12494aa44a3dfcbe8122f5fca7d7d939b97c63cc9986b1fc78218c7dfe127fe993c0df1edc899d84f61202d27007893e3b06ea7c55104146b29d9c6b374d5fda4ec996434ee56139a3b28189d2fe3043e65e67b7de14e4ce729f3a19873f8bd01221e0a2e69f58cbc16dc38513646f3bfe8a00fa6a93b317a5060240a1512b5fffbe433775bd18320ecbc6cfe8ada3412f8cbebefb97dc87465721e71ae1d2e0e5daa1356f47869262b67628a2beb0cf792c48ed73d2ba7d02b93c3d9d4aa5a23b06d4043d706c35363ad9d3ea78fe5fdbbf8acba837bb05a05415645281681fa69b2ada41738c1f3429", 0xeb) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1036.044265][ T4406] should_fail+0x230/0x240 [ 1036.048713][ T4406] __alloc_pages+0xf0/0x320 [ 1036.053217][ T4406] alloc_pages_vma+0x66d/0x7e0 [ 1036.057983][ T4406] ? __this_cpu_preempt_check+0xf/0x10 [ 1036.063447][ T4406] shmem_alloc_and_acct_page+0x219/0x580 [ 1036.069110][ T4406] shmem_getpage_gfp+0x300/0x16c0 [ 1036.074223][ T4406] shmem_write_begin+0x84/0x110 [ 1036.079080][ T4406] generic_perform_write+0x1d6/0x3f0 [ 1036.084370][ T4406] ? shmem_write_begin+0x110/0x110 [ 1036.089574][ T4406] __generic_file_write_iter+0xe3/0x280 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1036.095222][ T4406] ? generic_write_checks+0x256/0x290 [ 1036.100613][ T4406] generic_file_write_iter+0x75/0x130 [ 1036.105995][ T4406] vfs_write+0x71c/0x890 [ 1036.110250][ T4406] ksys_write+0xe8/0x1a0 [ 1036.114501][ T4406] __x64_sys_write+0x3e/0x50 [ 1036.119296][ T4406] do_syscall_64+0x2b/0x70 [ 1036.123809][ T4406] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1036.129705][ T4406] RIP: 0033:0x7f66d72200e9 [ 1036.134160][ T4406] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1036.153762][ T4406] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1036.162228][ T4406] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1036.170242][ T4406] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1036.178263][ T4406] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1036.186387][ T4406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 20:03:58 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 15) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 3: fsopen(&(0x7f0000000000)='tmpfs\x00', 0x0) (async, rerun: 32) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000140)='\x00\xd4\xdb\x9f]\x13`\x06\xf44\x98\x8f\x8c\x8a\xf6\xf4\xd4\xf1\x80\xd2{\xechc\x88\xd93\x91\xee\x9ec\xc5\xc0\x04x\xb9\xfd\x8d\xadU%Q\xfc\xe4)\xf1\x8c\xf1\x97\r\xd0\x85\x1a\xf8\x85\xe9\x00\xda\xf5D\x9d;\xbb\xcaE\xc7\x17*\xd2S\x1c]\x1e\xca;\x91\xa5\xbe\x1b\xf9R\xa1C\x00\tQ\xee\xf3\xb7\xe5\xdb\\T;\xd6GdT&\x9f\xdad{\xaa]\xd5\x01\x98\xb6\xa4\x17\x182\xf5}\xf8h\t\xee\xcbR\xfe!\xf8Tg\xfa\x0f\xba1\xbb\x82\xb9uc\xe2\xa8\x9a\x93\xbc\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000040)="6a12494aa44a3dfcbe8122f5fca7d7d939b97c63cc9986b1fc78218c7dfe127fe993c0df1edc899d84f61202d27007893e3b06ea7c55104146b29d9c6b374d5fda4ec996434ee56139a3b28189d2fe3043e65e67b7de14e4ce729f3a19873f8bd01221e0a2e69f58cbc16dc38513646f3bfe8a00fa6a93b317a5060240a1512b5fffbe433775bd18320ecbc6cfe8ada3412f8cbebefb97dc87465721e71ae1d2e0e5daa1356f47869262b67628a2beb0cf792c48ed73d2ba7d02b93c3d9d4aa5a23b06d4043d706c35363ad9d3ea78fe5fdbbf8acba837bb05a05415645281681fa69b2ada41738c1f3429", 0xeb) 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f00000001c0)={0x8, 0x120, 0xfa00, {0x4, {0x10001, 0x81, "9c922469e746c2187370c0553b2fd9a314190b5e50a8f73f3f79b39de80392d9aff542c8c6d8bf940d2ad2cb900f776e4cb7cb6b00c8b82ba424a329d71afdeff7cdabab612320968a01e341b9d472d796cd5374d528b8bcf2b2e7767e0ec7aecc7ae66cb2167b5bd2cc7547e41234f41c5cae01055d3dc4f4ca8ecf7516192fff91b3f8a48b467345e2f55eb22ef2ca98c30a2bda0546b680c7d58e21413bc4286a3090e3dfcdaf2656f4a5d70f2921d302edff4c9f9bd7a679a9d4833a7c789ad1aa351ff970fcf6ed976527de55c17b5f7c8fc4e8420464d3deabb8d47c7945928eafec0ced1d1793c95152797c833ca58391bb3e2fa3af4445da7b8fd8c3", 0x1f, 0xce, 0x9, 0x6, 0x3f, 0xfb, 0x20, 0x1}, r2}}, 0x128) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r2, 0x80000000}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x0, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:58 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async, rerun: 64) r1 = fsopen(&(0x7f0000000100)='anon_inodefs\x00', 0x1) (async, rerun: 64) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000140)='\x00', 0x0, r2) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) r4 = io_uring_setup(0x4c4, &(0x7f0000000000)={0x0, 0xd8ff, 0x8, 0x0, 0x1fb, 0x0, r3}) (async, rerun: 64) r5 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r6) (async) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0xa, 0x0, r6) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (rerun: 64) write$P9_RREADDIR(r0, 0x0, 0xffcb) [ 1036.194425][ T4406] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1036.202413][ T4406] 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x3, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x3, @remote, 0x2}, r4}}, 0x30) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/175, 0xaf}, &(0x7f0000001100)=0x40) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x0, 0x8a41, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1036.236878][ T4449] FAULT_INJECTION: forcing a failure. [ 1036.236878][ T4449] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1036.250160][ T4449] CPU: 0 PID: 4449 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1036.261097][ T4449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.271201][ T4449] Call Trace: [ 1036.274470][ T4449] [ 1036.277394][ T4449] dump_stack_lvl+0xd6/0x122 [ 1036.282050][ T4449] dump_stack+0x11/0x12 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x3, @remote, 0x2}, r4}}, 0x30) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) (async) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x3, @remote, 0x2}, r4}}, 0x30) (async) [ 1036.286380][ T4449] should_fail+0x230/0x240 [ 1036.290799][ T4449] __alloc_pages+0xf0/0x320 [ 1036.295305][ T4449] alloc_pages_vma+0x66d/0x7e0 [ 1036.300082][ T4449] ? __this_cpu_preempt_check+0xf/0x10 [ 1036.305546][ T4449] shmem_alloc_and_acct_page+0x219/0x580 [ 1036.311245][ T4449] shmem_getpage_gfp+0x300/0x16c0 [ 1036.316386][ T4449] shmem_write_begin+0x84/0x110 [ 1036.321254][ T4449] generic_perform_write+0x1d6/0x3f0 [ 1036.326595][ T4449] ? shmem_write_begin+0x110/0x110 [ 1036.331765][ T4449] __generic_file_write_iter+0xe3/0x280 [ 1036.337314][ T4449] ? generic_write_checks+0x256/0x290 [ 1036.342757][ T4449] generic_file_write_iter+0x75/0x130 [ 1036.348304][ T4449] vfs_write+0x71c/0x890 [ 1036.352571][ T4449] ksys_write+0xe8/0x1a0 [ 1036.356797][ T4449] __x64_sys_write+0x3e/0x50 [ 1036.361380][ T4449] do_syscall_64+0x2b/0x70 [ 1036.365791][ T4449] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1036.371663][ T4449] RIP: 0033:0x7f66d72200e9 [ 1036.376055][ T4449] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1036.395807][ T4449] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1036.404347][ T4449] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1036.412381][ T4449] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1036.420342][ T4449] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1036.428293][ T4449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 20:03:58 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 16) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x0, 0x0, 0x4, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:58 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x3, @remote, 0x2}, r4}}, 0x30) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) (async) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x3, @remote, 0x2}, r4}}, 0x30) (async) 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/175, 0xaf}, &(0x7f0000001100)=0x40) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/175, 0xaf}, &(0x7f0000001100)=0x40) (async) 20:03:58 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) r1 = fsopen(&(0x7f0000000100)='anon_inodefs\x00', 0x1) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000140)='\x00', 0x0, r2) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) r4 = io_uring_setup(0x4c4, &(0x7f0000000000)={0x0, 0xd8ff, 0x8, 0x0, 0x1fb, 0x0, r3}) r5 = syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r6) (async) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0xa, 0x0, r6) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:03:58 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) 20:03:58 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) 20:03:58 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:58 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x0, 0x0, 0x0, 0x101, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) [ 1036.436252][ T4449] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1036.444228][ T4449] 20:03:58 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/175, 0xaf}, &(0x7f0000001100)=0x40) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/175, 0xaf}, &(0x7f0000001100)=0x40) (async) 20:03:58 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000240), 0x2, r3, 0x10, 0x1, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0xa0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000004c0)={0x0, 0xffffffffffffffa0, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r7, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r8}}, 0xc) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x3c, r1, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x50) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r4, &(0x7f00000001c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r8, 0x5}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r6}}, 0x18) [ 1036.498813][ T4499] FAULT_INJECTION: forcing a failure. [ 1036.498813][ T4499] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1036.511977][ T4499] CPU: 0 PID: 4499 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1036.522915][ T4499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.532968][ T4499] Call Trace: [ 1036.536246][ T4499] [ 1036.539236][ T4499] dump_stack_lvl+0xd6/0x122 [ 1036.544179][ T4499] dump_stack+0x11/0x12 [ 1036.548353][ T4499] should_fail+0x230/0x240 [ 1036.552765][ T4499] should_fail_usercopy+0x16/0x20 [ 1036.557776][ T4499] copy_page_from_iter_atomic+0x3de/0xb80 [ 1036.563508][ T4499] ? shmem_write_begin+0x84/0x110 [ 1036.568582][ T4499] generic_perform_write+0x21a/0x3f0 [ 1036.573854][ T4499] ? shmem_write_begin+0x110/0x110 [ 1036.579012][ T4499] __generic_file_write_iter+0xe3/0x280 [ 1036.584583][ T4499] ? generic_write_checks+0x256/0x290 [ 1036.590009][ T4499] generic_file_write_iter+0x75/0x130 [ 1036.595370][ T4499] vfs_write+0x71c/0x890 [ 1036.599613][ T4499] ksys_write+0xe8/0x1a0 [ 1036.603883][ T4499] __x64_sys_write+0x3e/0x50 [ 1036.608460][ T4499] do_syscall_64+0x2b/0x70 [ 1036.612864][ T4499] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1036.618740][ T4499] RIP: 0033:0x7f66d72200e9 [ 1036.623139][ T4499] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:59 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 17) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:59 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x0, 0x0, 0x0, 0x0, 0xc49, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:59 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x8) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f00000008c0)={0x0, 0x0, 0x1, [0x6, 0x5, 0x6f911696, 0x50b1, 0x7], [0x34f, 0x1, 0x80000001, 0x3, 0x2ce84f0b, 0xd4, 0x5, 0x1, 0xfffffffffffff835, 0x1, 0x7, 0x78, 0x8, 0x7, 0x3ec0, 0x3ff, 0x80000000, 0x0, 0xfffffffffffffffe, 0xa94, 0xaba, 0xfb, 0x81, 0x38f, 0xffffffffffffffec, 0x8000, 0x0, 0x4, 0xe375, 0x401, 0x8d, 0x7, 0x1, 0x1, 0xffffffffffffffff, 0x3f, 0x1, 0xdac4, 0x8, 0x3, 0x7ff, 0x4, 0x7fffffffffffffff, 0x5, 0x6, 0x9, 0x4, 0x8, 0xe67, 0xfffffffffffffe00, 0xacc, 0x2, 0x1ff, 0x1, 0x3, 0x401, 0xde0, 0x4, 0x9, 0x7, 0xb8e, 0x1, 0xffffffff, 0x9, 0x23, 0xb2, 0x4, 0x4, 0xa0, 0x1, 0x0, 0x6, 0x4, 0x5, 0x80000000, 0x3, 0x1000, 0xccd, 0x7, 0x4, 0x16, 0x800, 0x8000, 0x40, 0x400, 0x6, 0x9b00, 0xfffffffffffffff8, 0xc24, 0x0, 0x7fff, 0xa3d, 0x0, 0x4, 0x6, 0x2, 0x76fc, 0xfffffffffffffff9, 0x1200000000000000, 0x0, 0x100000000, 0x9, 0x4, 0x4, 0x8000000000000000, 0x7, 0x9, 0x6, 0x8, 0xb4b, 0x10001, 0x3, 0x0, 0x1, 0x100, 0x8, 0x1, 0xe86, 0x570, 0x304897f9, 0xffffffffffffffff]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000d00)={r3, 0x4, 0x4, 0x1}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000cff05000201000000bf9ae9"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf2fe40000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, &(0x7f0000000040)={0x6, 0x1}) r5 = socket$xdp(0x2c, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001100)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x20010, r5, 0x180000000) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r6, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000240), 0x2, r3, 0x10, 0x1, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0xa0) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000004c0)={0x0, 0xffffffffffffffa0, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r7, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r8}}, 0xc) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x3c, r1, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x50) (async) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r4, &(0x7f00000001c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r8, 0x5}}, 0x18) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r6}}, 0x18) 20:03:59 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) [ 1036.642727][ T4499] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1036.651120][ T4499] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1036.659071][ T4499] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1036.667022][ T4499] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1036.674975][ T4499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1036.682928][ T4499] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1036.690943][ T4499] 20:03:59 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:59 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x8) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f00000008c0)={0x0, 0x0, 0x1, [0x6, 0x5, 0x6f911696, 0x50b1, 0x7], [0x34f, 0x1, 0x80000001, 0x3, 0x2ce84f0b, 0xd4, 0x5, 0x1, 0xfffffffffffff835, 0x1, 0x7, 0x78, 0x8, 0x7, 0x3ec0, 0x3ff, 0x80000000, 0x0, 0xfffffffffffffffe, 0xa94, 0xaba, 0xfb, 0x81, 0x38f, 0xffffffffffffffec, 0x8000, 0x0, 0x4, 0xe375, 0x401, 0x8d, 0x7, 0x1, 0x1, 0xffffffffffffffff, 0x3f, 0x1, 0xdac4, 0x8, 0x3, 0x7ff, 0x4, 0x7fffffffffffffff, 0x5, 0x6, 0x9, 0x4, 0x8, 0xe67, 0xfffffffffffffe00, 0xacc, 0x2, 0x1ff, 0x1, 0x3, 0x401, 0xde0, 0x4, 0x9, 0x7, 0xb8e, 0x1, 0xffffffff, 0x9, 0x23, 0xb2, 0x4, 0x4, 0xa0, 0x1, 0x0, 0x6, 0x4, 0x5, 0x80000000, 0x3, 0x1000, 0xccd, 0x7, 0x4, 0x16, 0x800, 0x8000, 0x40, 0x400, 0x6, 0x9b00, 0xfffffffffffffff8, 0xc24, 0x0, 0x7fff, 0xa3d, 0x0, 0x4, 0x6, 0x2, 0x76fc, 0xfffffffffffffff9, 0x1200000000000000, 0x0, 0x100000000, 0x9, 0x4, 0x4, 0x8000000000000000, 0x7, 0x9, 0x6, 0x8, 0xb4b, 0x10001, 0x3, 0x0, 0x1, 0x100, 0x8, 0x1, 0xe86, 0x570, 0x304897f9, 0xffffffffffffffff]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000d00)={r3, 0x4, 0x4, 0x1}) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000cff05000201000000bf9ae9"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf2fe40000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, &(0x7f0000000040)={0x6, 0x1}) r5 = socket$xdp(0x2c, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001100)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x20010, r5, 0x180000000) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r6, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 20:03:59 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x8) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f00000008c0)={0x0, 0x0, 0x1, [0x6, 0x5, 0x6f911696, 0x50b1, 0x7], [0x34f, 0x1, 0x80000001, 0x3, 0x2ce84f0b, 0xd4, 0x5, 0x1, 0xfffffffffffff835, 0x1, 0x7, 0x78, 0x8, 0x7, 0x3ec0, 0x3ff, 0x80000000, 0x0, 0xfffffffffffffffe, 0xa94, 0xaba, 0xfb, 0x81, 0x38f, 0xffffffffffffffec, 0x8000, 0x0, 0x4, 0xe375, 0x401, 0x8d, 0x7, 0x1, 0x1, 0xffffffffffffffff, 0x3f, 0x1, 0xdac4, 0x8, 0x3, 0x7ff, 0x4, 0x7fffffffffffffff, 0x5, 0x6, 0x9, 0x4, 0x8, 0xe67, 0xfffffffffffffe00, 0xacc, 0x2, 0x1ff, 0x1, 0x3, 0x401, 0xde0, 0x4, 0x9, 0x7, 0xb8e, 0x1, 0xffffffff, 0x9, 0x23, 0xb2, 0x4, 0x4, 0xa0, 0x1, 0x0, 0x6, 0x4, 0x5, 0x80000000, 0x3, 0x1000, 0xccd, 0x7, 0x4, 0x16, 0x800, 0x8000, 0x40, 0x400, 0x6, 0x9b00, 0xfffffffffffffff8, 0xc24, 0x0, 0x7fff, 0xa3d, 0x0, 0x4, 0x6, 0x2, 0x76fc, 0xfffffffffffffff9, 0x1200000000000000, 0x0, 0x100000000, 0x9, 0x4, 0x4, 0x8000000000000000, 0x7, 0x9, 0x6, 0x8, 0xb4b, 0x10001, 0x3, 0x0, 0x1, 0x100, 0x8, 0x1, 0xe86, 0x570, 0x304897f9, 0xffffffffffffffff]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000d00)={r3, 0x4, 0x4, 0x1}) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000cff05000201000000bf9ae9"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf2fe40000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, &(0x7f0000000040)={0x6, 0x1}) r5 = socket$xdp(0x2c, 0x3, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001100)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x20010, r5, 0x180000000) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r6, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 20:03:59 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r3}}, 0xc) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000240), 0x2, r3, 0x10, 0x1, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0xa0) (async) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000004c0)={0x0, 0xffffffffffffffa0, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r7, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r8}}, 0xc) (async) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x3c, r1, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x50) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r4, &(0x7f00000001c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000080), r8, 0x5}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r6}}, 0x18) 20:03:59 executing program 3: mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x800005, 0x10, 0xffffffffffffffff, 0x80000000) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1036.734404][ T4529] FAULT_INJECTION: forcing a failure. [ 1036.734404][ T4529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1036.747484][ T4529] CPU: 0 PID: 4529 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1036.758540][ T4529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.768667][ T4529] Call Trace: [ 1036.772014][ T4529] [ 1036.774967][ T4529] dump_stack_lvl+0xd6/0x122 [ 1036.779569][ T4529] dump_stack+0x11/0x12 20:03:59 executing program 1: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x1}, 0xf) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) [ 1036.783734][ T4529] should_fail+0x230/0x240 [ 1036.788165][ T4529] should_fail_usercopy+0x16/0x20 [ 1036.793274][ T4529] copy_page_from_iter_atomic+0x3de/0xb80 [ 1036.798998][ T4529] ? shmem_write_begin+0x84/0x110 [ 1036.804180][ T4529] generic_perform_write+0x21a/0x3f0 [ 1036.809515][ T4529] ? shmem_write_begin+0x110/0x110 [ 1036.814644][ T4529] __generic_file_write_iter+0xe3/0x280 [ 1036.820269][ T4529] ? generic_write_checks+0x256/0x290 [ 1036.825756][ T4529] generic_file_write_iter+0x75/0x130 [ 1036.831133][ T4529] vfs_write+0x71c/0x890 [ 1036.835447][ T4529] ksys_write+0xe8/0x1a0 [ 1036.839777][ T4529] __x64_sys_write+0x3e/0x50 [ 1036.844369][ T4529] do_syscall_64+0x2b/0x70 [ 1036.849114][ T4529] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1036.854991][ T4529] RIP: 0033:0x7f66d72200e9 [ 1036.859381][ T4529] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:03:59 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 18) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:59 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:59 executing program 3: mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x800005, 0x10, 0xffffffffffffffff, 0x80000000) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 1: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x1}, 0xf) (async) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) [ 1036.878963][ T4529] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1036.887362][ T4529] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1036.895312][ T4529] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1036.903262][ T4529] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1036.911214][ T4529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1036.919178][ T4529] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1036.927130][ T4529] 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 3: mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x800005, 0x10, 0xffffffffffffffff, 0x80000000) (async, rerun: 32) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (rerun: 32) 20:03:59 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x8a1c2964c333daf6) syz_io_uring_setup(0x1d91, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x2cb}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_RECVMSG={0xa, 0x5, 0x0, r0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000001740)=[{&(0x7f00000001c0)=""/245, 0xf5}, {&(0x7f00000004c0)=""/207, 0xcf}, {&(0x7f00000005c0)=""/133, 0x85}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/136, 0x88}], 0x5}, 0x0, 0x100, 0x1, {0x1}}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd=r0}, 0x8) write$cgroup_freezer_state(r0, &(0x7f0000000100)='THAWED\x00', 0x7) [ 1036.963612][ T4561] FAULT_INJECTION: forcing a failure. [ 1036.963612][ T4561] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1036.976966][ T4561] CPU: 1 PID: 4561 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1036.987916][ T4561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.997971][ T4561] Call Trace: [ 1037.001246][ T4561] [ 1037.004175][ T4561] dump_stack_lvl+0xd6/0x122 [ 1037.008772][ T4561] dump_stack+0x11/0x12 20:03:59 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x5, 0xffffffffffffffff, 0x1) 20:03:59 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x8a1c2964c333daf6) syz_io_uring_setup(0x1d91, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x2cb}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_RECVMSG={0xa, 0x5, 0x0, r0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000001740)=[{&(0x7f00000001c0)=""/245, 0xf5}, {&(0x7f00000004c0)=""/207, 0xcf}, {&(0x7f00000005c0)=""/133, 0x85}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/136, 0x88}], 0x5}, 0x0, 0x100, 0x1, {0x1}}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd=r0}, 0x8) write$cgroup_freezer_state(r0, &(0x7f0000000100)='THAWED\x00', 0x7) syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x8a1c2964c333daf6) (async) syz_io_uring_setup(0x1d91, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x2cb}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_RECVMSG={0xa, 0x5, 0x0, r0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000001740)=[{&(0x7f00000001c0)=""/245, 0xf5}, {&(0x7f00000004c0)=""/207, 0xcf}, {&(0x7f00000005c0)=""/133, 0x85}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/136, 0x88}], 0x5}, 0x0, 0x100, 0x1, {0x1}}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) (async) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) (async) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd=r0}, 0x8) (async) write$cgroup_freezer_state(r0, &(0x7f0000000100)='THAWED\x00', 0x7) (async) 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, 0x0) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1037.012934][ T4561] should_fail+0x230/0x240 [ 1037.017401][ T4561] __alloc_pages+0xf0/0x320 [ 1037.021910][ T4561] alloc_pages_vma+0x66d/0x7e0 [ 1037.026678][ T4561] ? __this_cpu_preempt_check+0xf/0x10 [ 1037.032139][ T4561] shmem_alloc_and_acct_page+0x219/0x580 [ 1037.037935][ T4561] shmem_getpage_gfp+0x300/0x16c0 [ 1037.042970][ T4561] shmem_write_begin+0x84/0x110 [ 1037.047887][ T4561] generic_perform_write+0x1d6/0x3f0 [ 1037.053174][ T4561] ? shmem_write_begin+0x110/0x110 [ 1037.058289][ T4561] __generic_file_write_iter+0xe3/0x280 [ 1037.063836][ T4561] ? generic_write_checks+0x256/0x290 [ 1037.069208][ T4561] generic_file_write_iter+0x75/0x130 [ 1037.074580][ T4561] vfs_write+0x71c/0x890 [ 1037.078867][ T4561] ksys_write+0xe8/0x1a0 [ 1037.083188][ T4561] __x64_sys_write+0x3e/0x50 [ 1037.087758][ T4561] do_syscall_64+0x2b/0x70 [ 1037.092187][ T4561] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1037.098057][ T4561] RIP: 0033:0x7f66d72200e9 [ 1037.102448][ T4561] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1037.122227][ T4561] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1037.130627][ T4561] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1037.138586][ T4561] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1037.146551][ T4561] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1037.154508][ T4561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 20:03:59 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 19) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:59 executing program 1: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x1}, 0xf) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) 20:03:59 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x8a1c2964c333daf6) syz_io_uring_setup(0x1d91, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x2cb}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_RECVMSG={0xa, 0x5, 0x0, r0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000001740)=[{&(0x7f00000001c0)=""/245, 0xf5}, {&(0x7f00000004c0)=""/207, 0xcf}, {&(0x7f00000005c0)=""/133, 0x85}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/136, 0x88}], 0x5}, 0x0, 0x100, 0x1, {0x1}}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) (async) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd=r0}, 0x8) (async) write$cgroup_freezer_state(r0, &(0x7f0000000100)='THAWED\x00', 0x7) 20:03:59 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x1) 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, 0x0) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:03:59 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, 0x0) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:03:59 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1037.162581][ T4561] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1037.170540][ T4561] [ 1037.185215][ T4594] FAULT_INJECTION: forcing a failure. [ 1037.185215][ T4594] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1037.198483][ T4594] CPU: 1 PID: 4594 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0xa131, 0xffffffffffffffff, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f00000000c0)={0x100000001, 0x20, 0x0, 0x20, 0x9f33}, 0x48) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7, 0xc}, 0x6) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = fsopen(&(0x7f0000000140)='qnx4\x00', 0x0) r5 = openat$cgroup_freezer_state(r0, &(0x7f0000000180), 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[r4, r2, r0, r1, r1, r5]}, 0x6) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000040)={0x5, 0x0, &(0x7f0000000000)=[r1]}, 0x1) 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1037.209517][ T4594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1037.219674][ T4594] Call Trace: [ 1037.222965][ T4594] [ 1037.225890][ T4594] dump_stack_lvl+0xd6/0x122 [ 1037.230540][ T4594] dump_stack+0x11/0x12 [ 1037.234715][ T4594] should_fail+0x230/0x240 [ 1037.239145][ T4594] __alloc_pages+0xf0/0x320 [ 1037.243656][ T4594] alloc_pages_vma+0x66d/0x7e0 [ 1037.248489][ T4594] ? __this_cpu_preempt_check+0xf/0x10 [ 1037.253972][ T4594] shmem_alloc_and_acct_page+0x219/0x580 [ 1037.259621][ T4594] shmem_getpage_gfp+0x300/0x16c0 20:03:59 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0xa131, 0xffffffffffffffff, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f00000000c0)={0x100000001, 0x20, 0x0, 0x20, 0x9f33}, 0x48) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7, 0xc}, 0x6) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = fsopen(&(0x7f0000000140)='qnx4\x00', 0x0) r5 = openat$cgroup_freezer_state(r0, &(0x7f0000000180), 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[r4, r2, r0, r1, r1, r5]}, 0x6) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000040)={0x5, 0x0, &(0x7f0000000000)=[r1]}, 0x1) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0xa131, 0xffffffffffffffff, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x4) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (async) write$tcp_mem(r2, &(0x7f00000000c0)={0x100000001, 0x20, 0x0, 0x20, 0x9f33}, 0x48) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7, 0xc}, 0x6) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsopen(&(0x7f0000000140)='qnx4\x00', 0x0) (async) openat$cgroup_freezer_state(r0, &(0x7f0000000180), 0x2, 0x0) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[r4, r2, r0, r1, r1, r5]}, 0x6) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000040)={0x5, 0x0, &(0x7f0000000000)=[r1]}, 0x1) (async) [ 1037.264773][ T4594] shmem_write_begin+0x84/0x110 [ 1037.269623][ T4594] generic_perform_write+0x1d6/0x3f0 [ 1037.275104][ T4594] ? shmem_write_begin+0x110/0x110 [ 1037.280255][ T4594] __generic_file_write_iter+0xe3/0x280 [ 1037.285824][ T4594] ? generic_write_checks+0x256/0x290 [ 1037.291196][ T4594] generic_file_write_iter+0x75/0x130 [ 1037.296649][ T4594] vfs_write+0x71c/0x890 [ 1037.300992][ T4594] ksys_write+0xe8/0x1a0 [ 1037.305247][ T4594] __x64_sys_write+0x3e/0x50 [ 1037.309915][ T4594] do_syscall_64+0x2b/0x70 [ 1037.314345][ T4594] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1037.320331][ T4594] RIP: 0033:0x7f66d72200e9 [ 1037.324746][ T4594] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1037.344364][ T4594] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1037.352760][ T4594] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 20:03:59 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:03:59 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000080), 0x3, r2, 0x10, 0x1, @ib={0x1b, 0x400, 0xc2c, {"7bed6dd9667c2d2e0f49f84503bc24cb"}, 0x0, 0x400, 0x1}}}, 0xa0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:03:59 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0xa131, 0xffffffffffffffff, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f00000000c0)={0x100000001, 0x20, 0x0, 0x20, 0x9f33}, 0x48) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7, 0xc}, 0x6) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r4 = fsopen(&(0x7f0000000140)='qnx4\x00', 0x0) (async) r5 = openat$cgroup_freezer_state(r0, &(0x7f0000000180), 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[r4, r2, r0, r1, r1, r5]}, 0x6) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000040)={0x5, 0x0, &(0x7f0000000000)=[r1]}, 0x1) 20:03:59 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x40180) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={r2, 0x20, &(0x7f0000000200)={&(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)=""/204, 0xcc}}, 0x10) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00020000000000000000100000f20e09646612892c79c238977d0830e8da52344cf2289e84dba74b5af97d197e94"], 0xe) socket$packet(0x11, 0x3, 0x300) 20:03:59 executing program 4: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1037.360820][ T4594] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1037.368786][ T4594] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1037.376801][ T4594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1037.384763][ T4594] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1037.392719][ T4594] 20:03:59 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000080), 0x3, r2, 0x10, 0x1, @ib={0x1b, 0x400, 0xc2c, {"7bed6dd9667c2d2e0f49f84503bc24cb"}, 0x0, 0x400, 0x1}}}, 0xa0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:03:59 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000080), 0x3, r2, 0x10, 0x1, @ib={0x1b, 0x400, 0xc2c, {"7bed6dd9667c2d2e0f49f84503bc24cb"}, 0x0, 0x400, 0x1}}}, 0xa0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x2, 0x5}}, 0x20) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000080), 0x3, r2, 0x10, 0x1, @ib={0x1b, 0x400, 0xc2c, {"7bed6dd9667c2d2e0f49f84503bc24cb"}, 0x0, 0x400, 0x1}}}, 0xa0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) (async) 20:03:59 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x4, @mcast2, 0xff}, r4}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) socket$tipc(0x1e, 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r2, 0x53, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e22, 0x10001, @mcast2, 0x2}}}, 0x118) r6 = fsmount(0xffffffffffffffff, 0x0, 0x72) write$RDMA_USER_CM_CMD_NOTIFY(r6, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r4, 0x9}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r7 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r7, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r7, @ANYBLOB="0800030045929ae4936128d6bd89acadbbd3cdeb4bf0539650678a54e803fe22c2282e95ab2ab279403841d92ca5e8e2c99efe35267af455c16a69ab85bf42c0d6765554518c33bb37df3ebf4b0502dac16d16f76f6faef6cc24d12a7d8a2f7fa7b1786e81bb85dee7b411ba43e34a254c72", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsmount(r7, 0x1, 0x6) [ 1037.410834][ T4642] FAULT_INJECTION: forcing a failure. [ 1037.410834][ T4642] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1037.423949][ T4642] CPU: 1 PID: 4642 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1037.434939][ T4642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1037.445080][ T4642] Call Trace: [ 1037.448356][ T4642] [ 1037.451289][ T4642] dump_stack_lvl+0xd6/0x122 [ 1037.455891][ T4642] dump_stack+0x11/0x12 [ 1037.460054][ T4642] should_fail+0x230/0x240 20:03:59 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:03:59 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x4, @mcast2, 0xff}, r4}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) socket$tipc(0x1e, 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r2, 0x53, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e22, 0x10001, @mcast2, 0x2}}}, 0x118) r6 = fsmount(0xffffffffffffffff, 0x0, 0x72) write$RDMA_USER_CM_CMD_NOTIFY(r6, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r4, 0x9}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r7 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r7, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r7, @ANYBLOB="0800030045929ae4936128d6bd89acadbbd3cdeb4bf0539650678a54e803fe22c2282e95ab2ab279403841d92ca5e8e2c99efe35267af455c16a69ab85bf42c0d6765554518c33bb37df3ebf4b0502dac16d16f76f6faef6cc24d12a7d8a2f7fa7b1786e81bb85dee7b411ba43e34a254c72", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsmount(r7, 0x1, 0x6) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) (async) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x4, @mcast2, 0xff}, r4}}, 0x30) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) socket$tipc(0x1e, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r2, 0x53, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e22, 0x10001, @mcast2, 0x2}}}, 0x118) (async) fsmount(0xffffffffffffffff, 0x0, 0x72) (async) write$RDMA_USER_CM_CMD_NOTIFY(r6, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r4, 0x9}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r7, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r7, @ANYBLOB="0800030045929ae4936128d6bd89acadbbd3cdeb4bf0539650678a54e803fe22c2282e95ab2ab279403841d92ca5e8e2c99efe35267af455c16a69ab85bf42c0d6765554518c33bb37df3ebf4b0502dac16d16f76f6faef6cc24d12a7d8a2f7fa7b1786e81bb85dee7b411ba43e34a254c72", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsmount(r7, 0x1, 0x6) (async) 20:03:59 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x4, @mcast2, 0xff}, r4}}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) socket$tipc(0x1e, 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r2, 0x53, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e22, 0x10001, @mcast2, 0x2}}}, 0x118) r6 = fsmount(0xffffffffffffffff, 0x0, 0x72) write$RDMA_USER_CM_CMD_NOTIFY(r6, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r4, 0x9}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r7 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r7, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r7, @ANYBLOB="0800030045929ae4936128d6bd89acadbbd3cdeb4bf0539650678a54e803fe22c2282e95ab2ab279403841d92ca5e8e2c99efe35267af455c16a69ab85bf42c0d6765554518c33bb37df3ebf4b0502dac16d16f76f6faef6cc24d12a7d8a2f7fa7b1786e81bb85dee7b411ba43e34a254c72", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsmount(r7, 0x1, 0x6) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r4}}, 0xc) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) (async) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0x4, @mcast2, 0xff}, r4}}, 0x30) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) socket$tipc(0x1e, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000004c0)={0x15, 0x110, 0xfa00, {r2, 0x53, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e22, 0x10001, @mcast2, 0x2}}}, 0x118) (async) fsmount(0xffffffffffffffff, 0x0, 0x72) (async) write$RDMA_USER_CM_CMD_NOTIFY(r6, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r4, 0x9}}, 0x10) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r7, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r7, @ANYBLOB="0800030045929ae4936128d6bd89acadbbd3cdeb4bf0539650678a54e803fe22c2282e95ab2ab279403841d92ca5e8e2c99efe35267af455c16a69ab85bf42c0d6765554518c33bb37df3ebf4b0502dac16d16f76f6faef6cc24d12a7d8a2f7fa7b1786e81bb85dee7b411ba43e34a254c72", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsmount(r7, 0x1, 0x6) (async) [ 1037.464476][ T4642] should_fail_usercopy+0x16/0x20 [ 1037.469568][ T4642] copy_page_from_iter_atomic+0x3de/0xb80 [ 1037.475291][ T4642] ? shmem_write_begin+0x84/0x110 [ 1037.480374][ T4642] generic_perform_write+0x21a/0x3f0 [ 1037.485705][ T4642] ? shmem_write_begin+0x110/0x110 [ 1037.490869][ T4642] __generic_file_write_iter+0xe3/0x280 [ 1037.496418][ T4642] ? generic_write_checks+0x256/0x290 [ 1037.501879][ T4642] generic_file_write_iter+0x75/0x130 [ 1037.507262][ T4642] vfs_write+0x71c/0x890 [ 1037.511597][ T4642] ksys_write+0xe8/0x1a0 [ 1037.515901][ T4642] __x64_sys_write+0x3e/0x50 [ 1037.520498][ T4642] do_syscall_64+0x2b/0x70 [ 1037.524960][ T4642] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1037.530857][ T4642] RIP: 0033:0x7f66d72200e9 [ 1037.535261][ T4642] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1037.555051][ T4642] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 20:04:00 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 21) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x40180) (async) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={r2, 0x20, &(0x7f0000000200)={&(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)=""/204, 0xcc}}, 0x10) (async) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00020000000000000000100000f20e09646612892c79c238977d0830e8da52344cf2289e84dba74b5af97d197e94"], 0xe) (async) socket$packet(0x11, 0x3, 0x300) 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {}, {0x0, @struct, 0x0}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000880)={r1, 0x4, 0x1, [0x3, 0x0, 0x4, 0x0, 0xfffffffffffffffa], [0x7fffffffffffffff, 0x4271, 0x8000000000000000, 0x9, 0x6, 0xffff, 0x7, 0x46d48440, 0x6, 0xbe0, 0x800, 0x8, 0x4, 0x2, 0x1, 0x101, 0x80000000, 0x1ff, 0x2, 0x7, 0x1, 0x9, 0x4, 0x4, 0xfff, 0x8, 0x3, 0x8000000000000000, 0x1, 0x400, 0x7, 0x2, 0xfffffffffffffff8, 0x5, 0x8000000000000000, 0x1, 0x10001, 0xfb7, 0x2, 0x0, 0x4, 0x0, 0x3, 0x1ff, 0x7, 0x0, 0x68, 0x1, 0x2, 0x400, 0x28000000000, 0x5, 0x8, 0x4, 0x8, 0x20, 0x34, 0x3, 0x2, 0xfffffffffffffff7, 0x10, 0x9, 0x8000000000000000, 0x5, 0xffffffff, 0x3, 0x51813d00, 0x3, 0x6, 0x4, 0xf43, 0x100000001, 0x5, 0xffff, 0x400, 0x101, 0x8, 0x8, 0xffff, 0x8, 0x55a, 0x9, 0x0, 0x81, 0x9, 0x2, 0x4, 0xfffffffffffffff8, 0x9, 0x7, 0x7, 0x4ed, 0x3e, 0x48, 0x101, 0x8, 0x2, 0xffffffffffffff81, 0x8, 0x800, 0x80000001, 0xd1e5, 0x3, 0x4, 0xf8, 0x80, 0x0, 0x3, 0x6, 0x4, 0x2, 0x0, 0x8000000000000001, 0x10000000000, 0x0, 0x2, 0x8000000000000000, 0x1000, 0xcd0, 0x40, 0x7]}) syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x48000) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:04:00 executing program 4: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, 0x0, 0xffcb) 20:04:00 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mq_timedreceive(r0, &(0x7f0000000000)=""/244, 0xf4, 0x7fffffffffffffff, &(0x7f0000000100)={0x0, 0x3938700}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mq_timedreceive(r0, &(0x7f0000000000)=""/244, 0xf4, 0x7fffffffffffffff, &(0x7f0000000100)={0x0, 0x3938700}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1037.563493][ T4642] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1037.571448][ T4642] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1037.579414][ T4642] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1037.587800][ T4642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1037.595830][ T4642] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1037.603785][ T4642] 20:04:00 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 32) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {}, {0x0, @struct, 0x0}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (rerun: 32) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000880)={r1, 0x4, 0x1, [0x3, 0x0, 0x4, 0x0, 0xfffffffffffffffa], [0x7fffffffffffffff, 0x4271, 0x8000000000000000, 0x9, 0x6, 0xffff, 0x7, 0x46d48440, 0x6, 0xbe0, 0x800, 0x8, 0x4, 0x2, 0x1, 0x101, 0x80000000, 0x1ff, 0x2, 0x7, 0x1, 0x9, 0x4, 0x4, 0xfff, 0x8, 0x3, 0x8000000000000000, 0x1, 0x400, 0x7, 0x2, 0xfffffffffffffff8, 0x5, 0x8000000000000000, 0x1, 0x10001, 0xfb7, 0x2, 0x0, 0x4, 0x0, 0x3, 0x1ff, 0x7, 0x0, 0x68, 0x1, 0x2, 0x400, 0x28000000000, 0x5, 0x8, 0x4, 0x8, 0x20, 0x34, 0x3, 0x2, 0xfffffffffffffff7, 0x10, 0x9, 0x8000000000000000, 0x5, 0xffffffff, 0x3, 0x51813d00, 0x3, 0x6, 0x4, 0xf43, 0x100000001, 0x5, 0xffff, 0x400, 0x101, 0x8, 0x8, 0xffff, 0x8, 0x55a, 0x9, 0x0, 0x81, 0x9, 0x2, 0x4, 0xfffffffffffffff8, 0x9, 0x7, 0x7, 0x4ed, 0x3e, 0x48, 0x101, 0x8, 0x2, 0xffffffffffffff81, 0x8, 0x800, 0x80000001, 0xd1e5, 0x3, 0x4, 0xf8, 0x80, 0x0, 0x3, 0x6, 0x4, 0x2, 0x0, 0x8000000000000001, 0x10000000000, 0x0, 0x2, 0x8000000000000000, 0x1000, 0xcd0, 0x40, 0x7]}) syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x48000) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x40180) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={r2, 0x20, &(0x7f0000000200)={&(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)=""/204, 0xcc}}, 0x10) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00020000000000000000100000f20e09646612892c79c238977d0830e8da52344cf2289e84dba74b5af97d197e94"], 0xe) socket$packet(0x11, 0x3, 0x300) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0x40180) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={r2, 0x20, &(0x7f0000000200)={&(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)=""/204, 0xcc}}, 0x10) (async) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00020000000000000000100000f20e09646612892c79c238977d0830e8da52344cf2289e84dba74b5af97d197e94"], 0xe) (async) socket$packet(0x11, 0x3, 0x300) (async) 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {}, {0x0, @struct, 0x0}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000880)={r1, 0x4, 0x1, [0x3, 0x0, 0x4, 0x0, 0xfffffffffffffffa], [0x7fffffffffffffff, 0x4271, 0x8000000000000000, 0x9, 0x6, 0xffff, 0x7, 0x46d48440, 0x6, 0xbe0, 0x800, 0x8, 0x4, 0x2, 0x1, 0x101, 0x80000000, 0x1ff, 0x2, 0x7, 0x1, 0x9, 0x4, 0x4, 0xfff, 0x8, 0x3, 0x8000000000000000, 0x1, 0x400, 0x7, 0x2, 0xfffffffffffffff8, 0x5, 0x8000000000000000, 0x1, 0x10001, 0xfb7, 0x2, 0x0, 0x4, 0x0, 0x3, 0x1ff, 0x7, 0x0, 0x68, 0x1, 0x2, 0x400, 0x28000000000, 0x5, 0x8, 0x4, 0x8, 0x20, 0x34, 0x3, 0x2, 0xfffffffffffffff7, 0x10, 0x9, 0x8000000000000000, 0x5, 0xffffffff, 0x3, 0x51813d00, 0x3, 0x6, 0x4, 0xf43, 0x100000001, 0x5, 0xffff, 0x400, 0x101, 0x8, 0x8, 0xffff, 0x8, 0x55a, 0x9, 0x0, 0x81, 0x9, 0x2, 0x4, 0xfffffffffffffff8, 0x9, 0x7, 0x7, 0x4ed, 0x3e, 0x48, 0x101, 0x8, 0x2, 0xffffffffffffff81, 0x8, 0x800, 0x80000001, 0xd1e5, 0x3, 0x4, 0xf8, 0x80, 0x0, 0x3, 0x6, 0x4, 0x2, 0x0, 0x8000000000000001, 0x10000000000, 0x0, 0x2, 0x8000000000000000, 0x1000, 0xcd0, 0x40, 0x7]}) syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x48000) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) [ 1037.665169][ T4736] FAULT_INJECTION: forcing a failure. [ 1037.665169][ T4736] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1037.678373][ T4736] CPU: 1 PID: 4736 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1037.689323][ T4736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1037.699378][ T4736] Call Trace: [ 1037.702660][ T4736] [ 1037.705747][ T4736] dump_stack_lvl+0xd6/0x122 [ 1037.710458][ T4736] dump_stack+0x11/0x12 [ 1037.714603][ T4736] should_fail+0x230/0x240 [ 1037.719037][ T4736] should_fail_usercopy+0x16/0x20 [ 1037.724041][ T4736] copy_page_from_iter_atomic+0x3de/0xb80 [ 1037.729757][ T4736] ? shmem_write_begin+0x84/0x110 [ 1037.734970][ T4736] generic_perform_write+0x21a/0x3f0 [ 1037.740307][ T4736] ? shmem_write_begin+0x110/0x110 [ 1037.745506][ T4736] __generic_file_write_iter+0xe3/0x280 [ 1037.751035][ T4736] ? generic_write_checks+0x256/0x290 [ 1037.756398][ T4736] generic_file_write_iter+0x75/0x130 [ 1037.761753][ T4736] vfs_write+0x71c/0x890 [ 1037.766042][ T4736] ksys_write+0xe8/0x1a0 [ 1037.770267][ T4736] __x64_sys_write+0x3e/0x50 [ 1037.774855][ T4736] do_syscall_64+0x2b/0x70 [ 1037.779337][ T4736] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1037.785209][ T4736] RIP: 0033:0x7f66d72200e9 [ 1037.789598][ T4736] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:04:00 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 22) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:00 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mq_timedreceive(r0, &(0x7f0000000000)=""/244, 0xf4, 0x7fffffffffffffff, &(0x7f0000000100)={0x0, 0x3938700}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:00 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {}, {0x0, @struct, 0x0}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000880)={r1, 0x4, 0x1, [0x3, 0x0, 0x4, 0x0, 0xfffffffffffffffa], [0x7fffffffffffffff, 0x4271, 0x8000000000000000, 0x9, 0x6, 0xffff, 0x7, 0x46d48440, 0x6, 0xbe0, 0x800, 0x8, 0x4, 0x2, 0x1, 0x101, 0x80000000, 0x1ff, 0x2, 0x7, 0x1, 0x9, 0x4, 0x4, 0xfff, 0x8, 0x3, 0x8000000000000000, 0x1, 0x400, 0x7, 0x2, 0xfffffffffffffff8, 0x5, 0x8000000000000000, 0x1, 0x10001, 0xfb7, 0x2, 0x0, 0x4, 0x0, 0x3, 0x1ff, 0x7, 0x0, 0x68, 0x1, 0x2, 0x400, 0x28000000000, 0x5, 0x8, 0x4, 0x8, 0x20, 0x34, 0x3, 0x2, 0xfffffffffffffff7, 0x10, 0x9, 0x8000000000000000, 0x5, 0xffffffff, 0x3, 0x51813d00, 0x3, 0x6, 0x4, 0xf43, 0x100000001, 0x5, 0xffff, 0x400, 0x101, 0x8, 0x8, 0xffff, 0x8, 0x55a, 0x9, 0x0, 0x81, 0x9, 0x2, 0x4, 0xfffffffffffffff8, 0x9, 0x7, 0x7, 0x4ed, 0x3e, 0x48, 0x101, 0x8, 0x2, 0xffffffffffffff81, 0x8, 0x800, 0x80000001, 0xd1e5, 0x3, 0x4, 0xf8, 0x80, 0x0, 0x3, 0x6, 0x4, 0x2, 0x0, 0x8000000000000001, 0x10000000000, 0x0, 0x2, 0x8000000000000000, 0x1000, 0xcd0, 0x40, 0x7]}) syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x48000) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000880)={r1, 0x4, 0x1, [0x3, 0x0, 0x4, 0x0, 0xfffffffffffffffa], [0x7fffffffffffffff, 0x4271, 0x8000000000000000, 0x9, 0x6, 0xffff, 0x7, 0x46d48440, 0x6, 0xbe0, 0x800, 0x8, 0x4, 0x2, 0x1, 0x101, 0x80000000, 0x1ff, 0x2, 0x7, 0x1, 0x9, 0x4, 0x4, 0xfff, 0x8, 0x3, 0x8000000000000000, 0x1, 0x400, 0x7, 0x2, 0xfffffffffffffff8, 0x5, 0x8000000000000000, 0x1, 0x10001, 0xfb7, 0x2, 0x0, 0x4, 0x0, 0x3, 0x1ff, 0x7, 0x0, 0x68, 0x1, 0x2, 0x400, 0x28000000000, 0x5, 0x8, 0x4, 0x8, 0x20, 0x34, 0x3, 0x2, 0xfffffffffffffff7, 0x10, 0x9, 0x8000000000000000, 0x5, 0xffffffff, 0x3, 0x51813d00, 0x3, 0x6, 0x4, 0xf43, 0x100000001, 0x5, 0xffff, 0x400, 0x101, 0x8, 0x8, 0xffff, 0x8, 0x55a, 0x9, 0x0, 0x81, 0x9, 0x2, 0x4, 0xfffffffffffffff8, 0x9, 0x7, 0x7, 0x4ed, 0x3e, 0x48, 0x101, 0x8, 0x2, 0xffffffffffffff81, 0x8, 0x800, 0x80000001, 0xd1e5, 0x3, 0x4, 0xf8, 0x80, 0x0, 0x3, 0x6, 0x4, 0x2, 0x0, 0x8000000000000001, 0x10000000000, 0x0, 0x2, 0x8000000000000000, 0x1000, 0xcd0, 0x40, 0x7]}) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x48000) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x0, 0x2}}, 0x20) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r3}}, 0x18) (async) 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 1) 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) write$P9_RREADDIR(r0, 0x0, 0xffcb) [ 1037.809192][ T4736] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1037.817582][ T4736] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1037.825560][ T4736] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1037.833599][ T4736] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1037.841549][ T4736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1037.849499][ T4736] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1037.857449][ T4736] 20:04:00 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x100000000) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) syz_io_uring_setup(0x75dd, &(0x7f0000000080)={0x0, 0x72d, 0x8, 0x3, 0x396, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_setup(0x230c, &(0x7f0000000180)={0x0, 0x464d, 0x2, 0x1, 0xb3, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000200), &(0x7f0000000240)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x1, 0x0, r3, 0x0, 0x0, 0x0, 0x21a2, 0xf2db4f2d1c6a2245, {0x3}}, 0x2) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbfd35010003000c000200000000fdff62e40300078108400100c17e7e00", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000339e97d531b5c58c9db2381e7db2f48050cd56631067171d"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r6, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r6, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40084) mmap$usbfs(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x810, r0, 0x7fff) socket$xdp(0x2c, 0x3, 0x0) 20:04:00 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x100000000) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) syz_io_uring_setup(0x75dd, &(0x7f0000000080)={0x0, 0x72d, 0x8, 0x3, 0x396, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_setup(0x230c, &(0x7f0000000180)={0x0, 0x464d, 0x2, 0x1, 0xb3, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000200), &(0x7f0000000240)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x1, 0x0, r3, 0x0, 0x0, 0x0, 0x21a2, 0xf2db4f2d1c6a2245, {0x3}}, 0x2) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbfd35010003000c000200000000fdff62e40300078108400100c17e7e00", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000339e97d531b5c58c9db2381e7db2f48050cd56631067171d"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r6, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r6, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40084) mmap$usbfs(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x810, r0, 0x7fff) socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x100000000) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) (async) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async) syz_io_uring_setup(0x75dd, &(0x7f0000000080)={0x0, 0x72d, 0x8, 0x3, 0x396, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x230c, &(0x7f0000000180)={0x0, 0x464d, 0x2, 0x1, 0xb3, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000200), &(0x7f0000000240)) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x1, 0x0, r3, 0x0, 0x0, 0x0, 0x21a2, 0xf2db4f2d1c6a2245, {0x3}}, 0x2) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbfd35010003000c000200000000fdff62e40300078108400100c17e7e00", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000339e97d531b5c58c9db2381e7db2f48050cd56631067171d"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r6, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) (async) sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r6, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40084) (async) mmap$usbfs(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x810, r0, 0x7fff) (async) socket$xdp(0x2c, 0x3, 0x0) (async) 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1037.880928][ T4756] FAULT_INJECTION: forcing a failure. [ 1037.880928][ T4756] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1037.894011][ T4756] CPU: 1 PID: 4756 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1037.904978][ T4756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1037.915135][ T4756] Call Trace: [ 1037.918409][ T4756] [ 1037.921331][ T4756] dump_stack_lvl+0xd6/0x122 [ 1037.925978][ T4756] dump_stack+0x11/0x12 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1000000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1037.930163][ T4756] should_fail+0x230/0x240 [ 1037.934659][ T4756] should_fail_usercopy+0x16/0x20 [ 1037.939737][ T4756] copy_page_from_iter_atomic+0x3de/0xb80 [ 1037.945463][ T4756] ? shmem_write_begin+0x84/0x110 [ 1037.949848][ T4761] FAULT_INJECTION: forcing a failure. [ 1037.949848][ T4761] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1037.950532][ T4756] generic_perform_write+0x21a/0x3f0 [ 1037.950556][ T4756] ? shmem_write_begin+0x110/0x110 [ 1037.950583][ T4756] __generic_file_write_iter+0xe3/0x280 [ 1037.950643][ T4756] ? generic_write_checks+0x256/0x290 [ 1037.984780][ T4756] generic_file_write_iter+0x75/0x130 [ 1037.990181][ T4756] vfs_write+0x71c/0x890 [ 1037.994445][ T4756] ksys_write+0xe8/0x1a0 [ 1037.998709][ T4756] __x64_sys_write+0x3e/0x50 [ 1038.003291][ T4756] do_syscall_64+0x2b/0x70 [ 1038.007694][ T4756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1038.013572][ T4756] RIP: 0033:0x7f66d72200e9 [ 1038.018038][ T4756] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1038.037699][ T4756] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1038.046098][ T4756] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1038.054052][ T4756] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1038.062129][ T4756] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1038.070082][ T4756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 23) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) [ 1038.078036][ T4756] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1038.086004][ T4756] [ 1038.089006][ T4761] CPU: 0 PID: 4761 Comm: syz-executor.4 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1038.099939][ T4761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1038.109994][ T4761] Call Trace: [ 1038.113265][ T4761] [ 1038.116246][ T4761] dump_stack_lvl+0xd6/0x122 [ 1038.120866][ T4761] dump_stack+0x11/0x12 [ 1038.125154][ T4761] should_fail+0x230/0x240 [ 1038.129604][ T4761] should_fail_usercopy+0x16/0x20 [ 1038.132840][ T4808] FAULT_INJECTION: forcing a failure. [ 1038.132840][ T4808] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1038.134631][ T4761] _copy_from_user+0x1a/0xc0 [ 1038.152186][ T4761] perf_copy_attr+0x159/0x5b0 [ 1038.156851][ T4761] __se_sys_perf_event_open+0xca/0x25c0 [ 1038.162432][ T4761] ? proc_fail_nth_write+0x127/0x150 [ 1038.167786][ T4761] ? preempt_count_add+0x51/0xa0 [ 1038.172711][ T4761] ? vfs_write+0x607/0x890 [ 1038.177117][ T4761] ? __fget_files+0x1d2/0x210 [ 1038.181790][ T4761] __x64_sys_perf_event_open+0x63/0x70 [ 1038.187451][ T4761] do_syscall_64+0x2b/0x70 [ 1038.191862][ T4761] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1038.197807][ T4761] RIP: 0033:0x7f08e5cec0e9 [ 1038.202280][ T4761] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1038.221871][ T4761] RSP: 002b:00007f08e5462168 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1038.230273][ T4761] RAX: ffffffffffffffda RBX: 00007f08e5dfef60 RCX: 00007f08e5cec0e9 [ 1038.238229][ T4761] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 1038.246295][ T4761] RBP: 00007f08e54621d0 R08: 0000000000000000 R09: 0000000000000000 [ 1038.254250][ T4761] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1038.262209][ T4761] R13: 00007ffdc0a1420f R14: 00007f08e5462300 R15: 0000000000022000 [ 1038.270175][ T4761] [ 1038.273187][ T4808] CPU: 1 PID: 4808 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1038.284283][ T4808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1038.294422][ T4808] Call Trace: [ 1038.297698][ T4808] [ 1038.300677][ T4808] dump_stack_lvl+0xd6/0x122 [ 1038.305276][ T4808] dump_stack+0x11/0x12 [ 1038.309442][ T4808] should_fail+0x230/0x240 [ 1038.313898][ T4808] should_fail_usercopy+0x16/0x20 [ 1038.318944][ T4808] copy_page_from_iter_atomic+0x3de/0xb80 [ 1038.324669][ T4808] ? shmem_write_begin+0x84/0x110 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:00 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 2) 20:04:00 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x100000000) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async, rerun: 64) syz_io_uring_setup(0x75dd, &(0x7f0000000080)={0x0, 0x72d, 0x8, 0x3, 0x396, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) (async, rerun: 64) syz_io_uring_setup(0x230c, &(0x7f0000000180)={0x0, 0x464d, 0x2, 0x1, 0xb3, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000200), &(0x7f0000000240)=0x0) (async) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x1, 0x0, r3, 0x0, 0x0, 0x0, 0x21a2, 0xf2db4f2d1c6a2245, {0x3}}, 0x2) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbfd35010003000c000200000000fdff62e40300078108400100c17e7e00", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r4, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000339e97d531b5c58c9db2381e7db2f48050cd56631067171d"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r6, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r6, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40084) (async) mmap$usbfs(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x810, r0, 0x7fff) (async) socket$xdp(0x2c, 0x3, 0x0) 20:04:00 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000280), r1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0xf000, 0x10001, {"462c3b50b97d9a159e84109a41f9c177"}, 0x8000, 0x0, 0x2}, @in={0x2, 0x4e22, @local}}}, 0x118) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000001c0)='\x00', &(0x7f0000000240)='\x00', 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x46, 0xa00) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000040)={0x0, 0x2, r4, 0x1aa}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1038.329747][ T4808] generic_perform_write+0x21a/0x3f0 [ 1038.335069][ T4808] ? shmem_write_begin+0x110/0x110 [ 1038.340243][ T4808] __generic_file_write_iter+0xe3/0x280 [ 1038.345833][ T4808] ? generic_write_checks+0x256/0x290 [ 1038.351360][ T4808] generic_file_write_iter+0x75/0x130 [ 1038.356741][ T4808] vfs_write+0x71c/0x890 [ 1038.361005][ T4808] ksys_write+0xe8/0x1a0 [ 1038.362163][ T4826] FAULT_INJECTION: forcing a failure. [ 1038.362163][ T4826] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1038.365347][ T4808] __x64_sys_write+0x3e/0x50 [ 1038.382956][ T4808] do_syscall_64+0x2b/0x70 [ 1038.387374][ T4808] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1038.393256][ T4808] RIP: 0033:0x7f66d72200e9 [ 1038.397668][ T4808] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1038.417305][ T4808] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1038.425761][ T4808] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1038.433719][ T4808] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1038.441673][ T4808] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1038.449627][ T4808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1038.457580][ T4808] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1038.465598][ T4808] [ 1038.468600][ T4826] CPU: 0 PID: 4826 Comm: syz-executor.4 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 20:04:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RSTAT(r1, &(0x7f0000000000)={0x52, 0x7d, 0x2, {0x0, 0x4b, 0x4, 0x3, {0x4, 0x1, 0x5}, 0xa000000, 0x2, 0x401, 0x800, 0xa, '/dev/vcs#\x00', 0xa, '/dev/vcs#\x00', 0x4, '$\xb2-]'}}, 0x52) 20:04:00 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RSTAT(r1, &(0x7f0000000000)={0x52, 0x7d, 0x2, {0x0, 0x4b, 0x4, 0x3, {0x4, 0x1, 0x5}, 0xa000000, 0x2, 0x401, 0x800, 0xa, '/dev/vcs#\x00', 0xa, '/dev/vcs#\x00', 0x4, '$\xb2-]'}}, 0x52) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$P9_RSTAT(r1, &(0x7f0000000000)={0x52, 0x7d, 0x2, {0x0, 0x4b, 0x4, 0x3, {0x4, 0x1, 0x5}, 0xa000000, 0x2, 0x401, 0x800, 0xa, '/dev/vcs#\x00', 0xa, '/dev/vcs#\x00', 0x4, '$\xb2-]'}}, 0x52) (async) 20:04:00 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000280), r1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0xf000, 0x10001, {"462c3b50b97d9a159e84109a41f9c177"}, 0x8000, 0x0, 0x2}, @in={0x2, 0x4e22, @local}}}, 0x118) (async) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000001c0)='\x00', &(0x7f0000000240)='\x00', 0x0) (async) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x46, 0xa00) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000040)={0x0, 0x2, r4, 0x1aa}) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:00 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 24) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:00 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) write$P9_RREADDIR(r0, 0x0, 0xffcb) [ 1038.479536][ T4826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1038.489692][ T4826] Call Trace: [ 1038.492971][ T4826] [ 1038.495905][ T4826] dump_stack_lvl+0xd6/0x122 [ 1038.500633][ T4826] dump_stack+0x11/0x12 [ 1038.504849][ T4826] should_fail+0x230/0x240 [ 1038.509284][ T4826] should_fail_usercopy+0x16/0x20 [ 1038.514330][ T4826] _copy_to_user+0x1a/0x90 [ 1038.518759][ T4826] simple_read_from_buffer+0xab/0x120 [ 1038.524149][ T4826] proc_fail_nth_read+0x10d/0x150 20:04:01 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000280), r1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0xf000, 0x10001, {"462c3b50b97d9a159e84109a41f9c177"}, 0x8000, 0x0, 0x2}, @in={0x2, 0x4e22, @local}}}, 0x118) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000001c0)='\x00', &(0x7f0000000240)='\x00', 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x46, 0xa00) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000040)={0x0, 0x2, r4, 0x1aa}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:01 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 1) [ 1038.529178][ T4826] ? proc_fault_inject_write+0x230/0x230 [ 1038.534814][ T4826] vfs_read+0x1a1/0x6a0 [ 1038.538985][ T4826] ? __fget_files+0x1d2/0x210 [ 1038.543671][ T4826] ksys_read+0xe8/0x1a0 [ 1038.547852][ T4826] __x64_sys_read+0x3e/0x50 [ 1038.552429][ T4826] do_syscall_64+0x2b/0x70 [ 1038.556857][ T4826] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1038.562852][ T4826] RIP: 0033:0x7f08e5c9ec9c [ 1038.567262][ T4826] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1038.579883][ T4846] FAULT_INJECTION: forcing a failure. [ 1038.579883][ T4846] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1038.586905][ T4826] RSP: 002b:00007f08e5462160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1038.586928][ T4826] RAX: ffffffffffffffda RBX: 00007f08e5dfef60 RCX: 00007f08e5c9ec9c [ 1038.586942][ T4826] RDX: 000000000000000f RSI: 00007f08e54621e0 RDI: 0000000000000003 [ 1038.587022][ T4826] RBP: 00007f08e54621d0 R08: 0000000000000000 R09: 0000000000000000 [ 1038.632322][ T4826] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1038.640283][ T4826] R13: 00007ffdc0a1420f R14: 00007f08e5462300 R15: 0000000000022000 [ 1038.648257][ T4826] [ 1038.651258][ T4846] CPU: 1 PID: 4846 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1038.662271][ T4846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1038.671897][ T4842] FAULT_INJECTION: forcing a failure. [ 1038.671897][ T4842] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1038.672363][ T4846] Call Trace: [ 1038.672371][ T4846] [ 1038.672378][ T4846] dump_stack_lvl+0xd6/0x122 [ 1038.696376][ T4846] dump_stack+0x11/0x12 [ 1038.700652][ T4846] should_fail+0x230/0x240 [ 1038.705055][ T4846] should_fail_usercopy+0x16/0x20 [ 1038.710192][ T4846] copy_page_from_iter_atomic+0x3de/0xb80 [ 1038.715898][ T4846] ? shmem_write_begin+0x84/0x110 [ 1038.720925][ T4846] generic_perform_write+0x21a/0x3f0 [ 1038.726201][ T4846] __generic_file_write_iter+0xe3/0x280 [ 1038.731849][ T4846] ? generic_write_checks+0x256/0x290 [ 1038.737208][ T4846] generic_file_write_iter+0x75/0x130 [ 1038.742569][ T4846] vfs_write+0x71c/0x890 [ 1038.746823][ T4846] ksys_write+0xe8/0x1a0 [ 1038.751072][ T4846] __x64_sys_write+0x3e/0x50 [ 1038.755731][ T4846] do_syscall_64+0x2b/0x70 [ 1038.760137][ T4846] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1038.766077][ T4846] RIP: 0033:0x7f2a5a8c30e9 [ 1038.770475][ T4846] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1038.790067][ T4846] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1038.798530][ T4846] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1038.806701][ T4846] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1038.814655][ T4846] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1038.822609][ T4846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 20:04:01 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 2) [ 1038.830560][ T4846] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1038.838519][ T4846] [ 1038.841594][ T4842] CPU: 0 PID: 4842 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1038.852527][ T4842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1038.862693][ T4850] FAULT_INJECTION: forcing a failure. [ 1038.862693][ T4850] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1038.862961][ T4842] Call Trace: [ 1038.862968][ T4842] [ 1038.862984][ T4842] dump_stack_lvl+0xd6/0x122 [ 1038.886876][ T4842] dump_stack+0x11/0x12 [ 1038.891069][ T4842] should_fail+0x230/0x240 [ 1038.895597][ T4842] should_fail_usercopy+0x16/0x20 [ 1038.900736][ T4842] copy_page_from_iter_atomic+0x3de/0xb80 [ 1038.906458][ T4842] ? shmem_write_begin+0x84/0x110 [ 1038.911475][ T4842] generic_perform_write+0x21a/0x3f0 [ 1038.916746][ T4842] ? shmem_write_begin+0x110/0x110 [ 1038.921846][ T4842] __generic_file_write_iter+0xe3/0x280 [ 1038.927442][ T4842] ? generic_write_checks+0x256/0x290 [ 1038.932797][ T4842] generic_file_write_iter+0x75/0x130 [ 1038.938153][ T4842] vfs_write+0x71c/0x890 [ 1038.942504][ T4842] ksys_write+0xe8/0x1a0 [ 1038.946732][ T4842] __x64_sys_write+0x3e/0x50 [ 1038.951382][ T4842] do_syscall_64+0x2b/0x70 [ 1038.955801][ T4842] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1038.961681][ T4842] RIP: 0033:0x7f66d72200e9 [ 1038.966089][ T4842] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1038.985743][ T4842] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1038.994174][ T4842] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1039.002130][ T4842] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1039.010087][ T4842] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1039.018040][ T4842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1039.026082][ T4842] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1039.034096][ T4842] [ 1039.037098][ T4850] CPU: 1 PID: 4850 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1039.048135][ T4850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1039.058341][ T4850] Call Trace: [ 1039.061620][ T4850] [ 1039.064552][ T4850] dump_stack_lvl+0xd6/0x122 [ 1039.069182][ T4850] dump_stack+0x11/0x12 [ 1039.073354][ T4850] should_fail+0x230/0x240 [ 1039.077777][ T4850] __alloc_pages+0xf0/0x320 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x400000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RSTAT(r1, &(0x7f0000000000)={0x52, 0x7d, 0x2, {0x0, 0x4b, 0x4, 0x3, {0x4, 0x1, 0x5}, 0xa000000, 0x2, 0x401, 0x800, 0xa, '/dev/vcs#\x00', 0xa, '/dev/vcs#\x00', 0x4, '$\xb2-]'}}, 0x52) 20:04:01 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 25) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000280), r1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0xf000, 0x10001, {"462c3b50b97d9a159e84109a41f9c177"}, 0x8000, 0x0, 0x2}, @in={0x2, 0x4e22, @local}}}, 0x118) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000001c0)='\x00', &(0x7f0000000240)='\x00', 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000), 0x46, 0xa00) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000040)={0x0, 0x2, r4, 0x1aa}) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000280), r1}}, 0x18) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r1, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0xf000, 0x10001, {"462c3b50b97d9a159e84109a41f9c177"}, 0x8000, 0x0, 0x2}, @in={0x2, 0x4e22, @local}}}, 0x118) (async) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000001c0)='\x00', &(0x7f0000000240)='\x00', 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000000), 0x46, 0xa00) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000040)={0x0, 0x2, r4, 0x1aa}) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) 20:04:01 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 4: perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1000000000000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 4: perf_event_open(&(0x7f00000001c0)={0x10, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1039.082345][ T4850] alloc_pages_vma+0x66d/0x7e0 [ 1039.087120][ T4850] ? __this_cpu_preempt_check+0xf/0x10 [ 1039.092666][ T4850] shmem_alloc_and_acct_page+0x219/0x580 [ 1039.098486][ T4850] shmem_getpage_gfp+0x300/0x16c0 [ 1039.103613][ T4850] shmem_write_begin+0x84/0x110 [ 1039.108678][ T4850] generic_perform_write+0x1d6/0x3f0 [ 1039.114008][ T4850] ? shmem_write_begin+0x110/0x110 [ 1039.119135][ T4850] __generic_file_write_iter+0xe3/0x280 [ 1039.125047][ T4850] ? generic_write_checks+0x256/0x290 [ 1039.130423][ T4850] generic_file_write_iter+0x75/0x130 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1039.135973][ T4850] vfs_write+0x71c/0x890 [ 1039.140231][ T4850] ksys_write+0xe8/0x1a0 [ 1039.144483][ T4850] __x64_sys_write+0x3e/0x50 [ 1039.149149][ T4850] do_syscall_64+0x2b/0x70 [ 1039.153616][ T4850] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1039.159675][ T4850] RIP: 0033:0x7f2a5a8c30e9 [ 1039.162699][ T4873] FAULT_INJECTION: forcing a failure. [ 1039.162699][ T4873] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1039.164087][ T4850] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1039.196789][ T4850] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1039.205203][ T4850] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1039.213224][ T4850] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1039.221182][ T4850] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1039.229171][ T4850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 20:04:01 executing program 4: perf_event_open(&(0x7f00000001c0)={0x400001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 3) 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1039.237150][ T4850] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1039.245109][ T4850] [ 1039.248114][ T4873] CPU: 0 PID: 4873 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1039.259051][ T4873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1039.269135][ T4873] Call Trace: [ 1039.272489][ T4873] [ 1039.275435][ T4873] dump_stack_lvl+0xd6/0x122 [ 1039.280040][ T4873] dump_stack+0x11/0x12 [ 1039.284202][ T4873] should_fail+0x230/0x240 [ 1039.288038][ T4888] FAULT_INJECTION: forcing a failure. [ 1039.288038][ T4888] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1039.288720][ T4873] should_fail_usercopy+0x16/0x20 [ 1039.306982][ T4873] copy_page_from_iter_atomic+0x3de/0xb80 [ 1039.312699][ T4873] ? shmem_write_begin+0x84/0x110 [ 1039.317733][ T4873] generic_perform_write+0x21a/0x3f0 [ 1039.323076][ T4873] ? shmem_write_begin+0x110/0x110 [ 1039.328184][ T4873] __generic_file_write_iter+0xe3/0x280 [ 1039.333725][ T4873] ? generic_write_checks+0x256/0x290 [ 1039.339121][ T4873] generic_file_write_iter+0x75/0x130 [ 1039.344501][ T4873] vfs_write+0x71c/0x890 [ 1039.348738][ T4873] ksys_write+0xe8/0x1a0 [ 1039.352972][ T4873] __x64_sys_write+0x3e/0x50 [ 1039.357657][ T4873] do_syscall_64+0x2b/0x70 [ 1039.362065][ T4873] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1039.367945][ T4873] RIP: 0033:0x7f66d72200e9 [ 1039.372351][ T4873] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1039.392053][ T4873] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1039.400465][ T4873] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1039.408528][ T4873] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1039.416489][ T4873] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1039.424456][ T4873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1039.432534][ T4873] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1039.440549][ T4873] [ 1039.443557][ T4888] CPU: 1 PID: 4888 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1039.454548][ T4888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1039.464602][ T4888] Call Trace: [ 1039.467883][ T4888] [ 1039.470835][ T4888] dump_stack_lvl+0xd6/0x122 [ 1039.475468][ T4888] dump_stack+0x11/0x12 [ 1039.479626][ T4888] should_fail+0x230/0x240 20:04:01 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0xfffffffffffffffd, 0x729902) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000080)=[r2, r0, r0, 0xffffffffffffffff], 0x4) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:01 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 26) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:01 executing program 4: perf_event_open(&(0x7f00000001c0)={0x1004000, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:01 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000040)=[r1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff, r3], 0x6) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:01 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000040)=[r1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff, r3], 0x6) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$tipc(0x1e, 0x5, 0x0) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000040)=[r1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff, r3], 0x6) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) 20:04:01 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000040)=[r1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff, r3], 0x6) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) socket$tipc(0x1e, 0x5, 0x0) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000040)=[r1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff, r3], 0x6) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) 20:04:02 executing program 3: sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040141}, 0x20048891) getsockopt$TIPC_NODE_RECVQ_DEPTH(0xffffffffffffffff, 0x10f, 0x83, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080)=0x54, 0x4) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1039.484181][ T4888] __alloc_pages+0xf0/0x320 [ 1039.488907][ T4888] alloc_pages_vma+0x66d/0x7e0 [ 1039.493767][ T4888] ? __this_cpu_preempt_check+0xf/0x10 [ 1039.499353][ T4888] shmem_alloc_and_acct_page+0x219/0x580 [ 1039.505037][ T4888] shmem_getpage_gfp+0x300/0x16c0 [ 1039.510074][ T4888] shmem_write_begin+0x84/0x110 [ 1039.514942][ T4888] generic_perform_write+0x1d6/0x3f0 [ 1039.520316][ T4888] ? shmem_write_begin+0x110/0x110 [ 1039.525464][ T4888] __generic_file_write_iter+0xe3/0x280 [ 1039.531013][ T4888] ? generic_write_checks+0x256/0x290 20:04:02 executing program 3: sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040141}, 0x20048891) getsockopt$TIPC_NODE_RECVQ_DEPTH(0xffffffffffffffff, 0x10f, 0x83, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080)=0x54, 0x4) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040141}, 0x20048891) (async) getsockopt$TIPC_NODE_RECVQ_DEPTH(0xffffffffffffffff, 0x10f, 0x83, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080)=0x54, 0x4) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) 20:04:02 executing program 3: sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040141}, 0x20048891) (async) getsockopt$TIPC_NODE_RECVQ_DEPTH(0xffffffffffffffff, 0x10f, 0x83, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080)=0x54, 0x4) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1039.536385][ T4888] generic_file_write_iter+0x75/0x130 [ 1039.541810][ T4888] vfs_write+0x71c/0x890 [ 1039.546160][ T4888] ksys_write+0xe8/0x1a0 [ 1039.550437][ T4888] __x64_sys_write+0x3e/0x50 [ 1039.555125][ T4888] do_syscall_64+0x2b/0x70 [ 1039.559618][ T4888] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1039.565520][ T4888] RIP: 0033:0x7f2a5a8c30e9 20:04:02 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 4) 20:04:02 executing program 4: perf_event_open(&(0x7f00000001c0)={0x4000000, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0xfffffffffffffffd, 0x729902) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000080)=[r2, r0, r0, 0xffffffffffffffff], 0x4) write$P9_RREADDIR(r0, 0x0, 0xffcb) [ 1039.569930][ T4888] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1039.571058][ T4918] FAULT_INJECTION: forcing a failure. [ 1039.571058][ T4918] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1039.589623][ T4888] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1039.589649][ T4888] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1039.589662][ T4888] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1039.589675][ T4888] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1039.589688][ T4888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1039.589701][ T4888] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1039.589718][ T4888] [ 1039.644975][ T4947] FAULT_INJECTION: forcing a failure. [ 1039.644975][ T4947] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1039.652018][ T4918] CPU: 0 PID: 4918 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1039.652046][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1039.689159][ T4918] Call Trace: [ 1039.692426][ T4918] [ 1039.695341][ T4918] dump_stack_lvl+0xd6/0x122 [ 1039.699930][ T4918] dump_stack+0x11/0x12 [ 1039.704220][ T4918] should_fail+0x230/0x240 [ 1039.708671][ T4918] __alloc_pages+0xf0/0x320 [ 1039.713165][ T4918] alloc_pages_vma+0x66d/0x7e0 [ 1039.717927][ T4918] ? __this_cpu_preempt_check+0xf/0x10 [ 1039.723374][ T4918] shmem_alloc_and_acct_page+0x219/0x580 [ 1039.729075][ T4918] shmem_getpage_gfp+0x300/0x16c0 [ 1039.734095][ T4918] shmem_write_begin+0x84/0x110 [ 1039.739135][ T4918] generic_perform_write+0x1d6/0x3f0 [ 1039.744409][ T4918] ? shmem_write_begin+0x110/0x110 [ 1039.749945][ T4918] __generic_file_write_iter+0xe3/0x280 [ 1039.755567][ T4918] ? generic_write_checks+0x256/0x290 [ 1039.760924][ T4918] generic_file_write_iter+0x75/0x130 [ 1039.766282][ T4918] vfs_write+0x71c/0x890 [ 1039.770520][ T4918] ksys_write+0xe8/0x1a0 [ 1039.774766][ T4918] __x64_sys_write+0x3e/0x50 [ 1039.779379][ T4918] do_syscall_64+0x2b/0x70 [ 1039.783821][ T4918] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1039.789716][ T4918] RIP: 0033:0x7f66d72200e9 [ 1039.794141][ T4918] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1039.814087][ T4918] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1039.822570][ T4918] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1039.830530][ T4918] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1039.838493][ T4918] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1039.846453][ T4918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1039.854422][ T4918] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1039.862525][ T4918] [ 1039.865571][ T4947] CPU: 1 PID: 4947 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1039.876583][ T4947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1039.886670][ T4947] Call Trace: 20:04:02 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 27) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:02 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) 20:04:02 executing program 4: perf_event_open(&(0x7f00000001c0)={0x10000000, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0xfffffffffffffffd, 0x729902) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000080)=[r2, r0, r0, 0xffffffffffffffff], 0x4) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:02 executing program 0: ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x2, 0x2}) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000140), 0x4) write$P9_RREADDIR(r0, 0x0, 0xffcb) write$P9_RSTAT(r0, &(0x7f0000000080)={0x43, 0x7d, 0x2, {0x0, 0x3c, 0x7, 0x7, {0x8, 0x4}, 0x22000000, 0x65, 0x3, 0x8, 0x1, '-', 0x3, '-#\xaf', 0x4, '.\'^]', 0x1, '\x00'}}, 0x43) pipe2$9p(&(0x7f0000000100), 0x900) 20:04:02 executing program 0: ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x2, 0x2}) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000140), 0x4) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) write$P9_RSTAT(r0, &(0x7f0000000080)={0x43, 0x7d, 0x2, {0x0, 0x3c, 0x7, 0x7, {0x8, 0x4}, 0x22000000, 0x65, 0x3, 0x8, 0x1, '-', 0x3, '-#\xaf', 0x4, '.\'^]', 0x1, '\x00'}}, 0x43) pipe2$9p(&(0x7f0000000100), 0x900) [ 1039.889944][ T4947] [ 1039.892871][ T4947] dump_stack_lvl+0xd6/0x122 [ 1039.897538][ T4947] dump_stack+0x11/0x12 [ 1039.901707][ T4947] should_fail+0x230/0x240 [ 1039.906220][ T4947] should_fail_usercopy+0x16/0x20 [ 1039.911469][ T4947] copy_page_from_iter_atomic+0x3de/0xb80 [ 1039.917193][ T4947] ? shmem_write_begin+0x84/0x110 [ 1039.922341][ T4947] generic_perform_write+0x21a/0x3f0 [ 1039.927630][ T4947] ? shmem_write_begin+0x110/0x110 [ 1039.932897][ T4947] __generic_file_write_iter+0xe3/0x280 [ 1039.938499][ T4947] ? generic_write_checks+0x256/0x290 [ 1039.943875][ T4947] generic_file_write_iter+0x75/0x130 [ 1039.945603][ T4960] FAULT_INJECTION: forcing a failure. [ 1039.945603][ T4960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1039.949270][ T4947] vfs_write+0x71c/0x890 [ 1039.966514][ T4947] ksys_write+0xe8/0x1a0 [ 1039.970752][ T4947] __x64_sys_write+0x3e/0x50 [ 1039.975334][ T4947] do_syscall_64+0x2b/0x70 [ 1039.979767][ T4947] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1039.985706][ T4947] RIP: 0033:0x7f2a5a8c30e9 [ 1039.990135][ T4947] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1040.009815][ T4947] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1040.018210][ T4947] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1040.026167][ T4947] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1040.034235][ T4947] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1040.042193][ T4947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.050149][ T4947] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1040.058117][ T4947] [ 1040.061118][ T4960] CPU: 0 PID: 4960 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1040.072102][ T4960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1040.082157][ T4960] Call Trace: [ 1040.085433][ T4960] [ 1040.088359][ T4960] dump_stack_lvl+0xd6/0x122 [ 1040.093082][ T4960] dump_stack+0x11/0x12 [ 1040.097349][ T4960] should_fail+0x230/0x240 [ 1040.100264][ T4974] FAULT_INJECTION: forcing a failure. [ 1040.100264][ T4974] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1040.101824][ T4960] should_fail_usercopy+0x16/0x20 [ 1040.101851][ T4960] copy_page_from_iter_atomic+0x3de/0xb80 [ 1040.101889][ T4960] ? shmem_write_begin+0x84/0x110 [ 1040.131173][ T4960] generic_perform_write+0x21a/0x3f0 [ 1040.136457][ T4960] ? shmem_write_begin+0x110/0x110 [ 1040.141572][ T4960] __generic_file_write_iter+0xe3/0x280 [ 1040.147112][ T4960] ? generic_write_checks+0x256/0x290 [ 1040.152505][ T4960] generic_file_write_iter+0x75/0x130 [ 1040.157875][ T4960] vfs_write+0x71c/0x890 [ 1040.162171][ T4960] ksys_write+0xe8/0x1a0 [ 1040.166403][ T4960] __x64_sys_write+0x3e/0x50 [ 1040.170987][ T4960] do_syscall_64+0x2b/0x70 [ 1040.175395][ T4960] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1040.181287][ T4960] RIP: 0033:0x7f66d72200e9 [ 1040.185687][ T4960] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1040.205276][ T4960] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1040.213744][ T4960] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1040.221756][ T4960] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1040.229775][ T4960] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 20:04:02 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 5) 20:04:02 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 4: perf_event_open(&(0x7f00000001c0)={0xffff0000, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) 20:04:02 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) [ 1040.237871][ T4960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1040.245940][ T4960] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1040.253939][ T4960] [ 1040.256945][ T4974] CPU: 1 PID: 4974 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1040.267885][ T4974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1040.277938][ T4974] Call Trace: [ 1040.281209][ T4974] [ 1040.284170][ T4974] dump_stack_lvl+0xd6/0x122 20:04:02 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 28) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:02 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RSYMLINK(r1, &(0x7f0000000200)={0x14, 0x11, 0x2, {0x2, 0x4}}, 0x14) write$P9_RXATTRWALK(r0, &(0x7f00000001c0)={0xf, 0x1f, 0x2, 0x9f}, 0xf) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000003c07a7065b70bc9aa5f0000000000000000000000000000000000000000000000000000000000000000ffff94bdc70b54d8d12be3bc28728dea7a03b488a2eb1256d8f414ac50a9365742c8c962e3f4642875400781581b0a528ee39b9c4546a72f447ab14ba6988d6cff37ceae45558f559e2e37949a5228167afcb7ce04e732a5bb3430a90f12e2a809cbb55062149704071e9dfd1b73c1b6ed3bfdd239160a2dadf8d799a4f6b9e150209387522a1890c243cffb5ce5756cd6e96047fb509eebf6439d232d554485d56f7410fcc60d4ea21ac855e050f8b860e178ff0b0983286cfc51093e769956fb861a1a1e56e336acb24c33", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08f090fd000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r2, 0x80000000) 20:04:02 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1040.288775][ T4974] dump_stack+0x11/0x12 [ 1040.293033][ T4974] should_fail+0x230/0x240 [ 1040.297456][ T4974] should_fail_usercopy+0x16/0x20 [ 1040.302488][ T4974] copy_page_from_iter_atomic+0x3de/0xb80 [ 1040.308215][ T4974] ? shmem_write_begin+0x84/0x110 [ 1040.313403][ T4974] generic_perform_write+0x21a/0x3f0 [ 1040.319125][ T4974] ? shmem_write_begin+0x110/0x110 [ 1040.320702][ T4986] FAULT_INJECTION: forcing a failure. [ 1040.320702][ T4986] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1040.324309][ T4974] __generic_file_write_iter+0xe3/0x280 [ 1040.324336][ T4974] ? generic_write_checks+0x256/0x290 [ 1040.348455][ T4974] generic_file_write_iter+0x75/0x130 [ 1040.353819][ T4974] vfs_write+0x71c/0x890 [ 1040.358056][ T4974] ksys_write+0xe8/0x1a0 [ 1040.362297][ T4974] __x64_sys_write+0x3e/0x50 [ 1040.366906][ T4974] do_syscall_64+0x2b/0x70 [ 1040.371330][ T4974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1040.377286][ T4974] RIP: 0033:0x7f2a5a8c30e9 [ 1040.381726][ T4974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1040.401320][ T4974] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1040.409736][ T4974] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1040.417690][ T4974] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1040.425647][ T4974] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1040.433602][ T4974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.441706][ T4974] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1040.449671][ T4974] [ 1040.452784][ T4986] CPU: 0 PID: 4986 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1040.463782][ T4986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1040.473838][ T4986] Call Trace: [ 1040.477183][ T4986] [ 1040.480119][ T4986] dump_stack_lvl+0xd6/0x122 [ 1040.484775][ T4986] dump_stack+0x11/0x12 20:04:02 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 6) 20:04:02 executing program 0: ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x2, 0x2}) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000140), 0x4) write$P9_RREADDIR(r0, 0x0, 0xffcb) write$P9_RSTAT(r0, &(0x7f0000000080)={0x43, 0x7d, 0x2, {0x0, 0x3c, 0x7, 0x7, {0x8, 0x4}, 0x22000000, 0x65, 0x3, 0x8, 0x1, '-', 0x3, '-#\xaf', 0x4, '.\'^]', 0x1, '\x00'}}, 0x43) pipe2$9p(&(0x7f0000000100), 0x900) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x2, 0x2}) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000140), 0x4) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) write$P9_RSTAT(r0, &(0x7f0000000080)={0x43, 0x7d, 0x2, {0x0, 0x3c, 0x7, 0x7, {0x8, 0x4}, 0x22000000, 0x65, 0x3, 0x8, 0x1, '-', 0x3, '-#\xaf', 0x4, '.\'^]', 0x1, '\x00'}}, 0x43) (async) pipe2$9p(&(0x7f0000000100), 0x900) (async) 20:04:02 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:02 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async, rerun: 32) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$P9_RSYMLINK(r1, &(0x7f0000000200)={0x14, 0x11, 0x2, {0x2, 0x4}}, 0x14) write$P9_RXATTRWALK(r0, &(0x7f00000001c0)={0xf, 0x1f, 0x2, 0x9f}, 0xf) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000003c07a7065b70bc9aa5f0000000000000000000000000000000000000000000000000000000000000000ffff94bdc70b54d8d12be3bc28728dea7a03b488a2eb1256d8f414ac50a9365742c8c962e3f4642875400781581b0a528ee39b9c4546a72f447ab14ba6988d6cff37ceae45558f559e2e37949a5228167afcb7ce04e732a5bb3430a90f12e2a809cbb55062149704071e9dfd1b73c1b6ed3bfdd239160a2dadf8d799a4f6b9e150209387522a1890c243cffb5ce5756cd6e96047fb509eebf6439d232d554485d56f7410fcc60d4ea21ac855e050f8b860e178ff0b0983286cfc51093e769956fb861a1a1e56e336acb24c33", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08f090fd000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r2, 0x80000000) 20:04:02 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1040.489004][ T4986] should_fail+0x230/0x240 [ 1040.493511][ T4986] __alloc_pages+0xf0/0x320 [ 1040.498107][ T4986] alloc_pages_vma+0x66d/0x7e0 [ 1040.502880][ T4986] ? __this_cpu_preempt_check+0xf/0x10 [ 1040.508457][ T4986] shmem_alloc_and_acct_page+0x219/0x580 [ 1040.514105][ T4986] shmem_getpage_gfp+0x300/0x16c0 [ 1040.519221][ T4986] shmem_write_begin+0x84/0x110 [ 1040.524089][ T4986] generic_perform_write+0x1d6/0x3f0 [ 1040.529451][ T4986] ? shmem_write_begin+0x110/0x110 [ 1040.532175][ T4994] FAULT_INJECTION: forcing a failure. [ 1040.532175][ T4994] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1040.534630][ T4986] __generic_file_write_iter+0xe3/0x280 [ 1040.534656][ T4986] ? generic_write_checks+0x256/0x290 [ 1040.558696][ T4986] generic_file_write_iter+0x75/0x130 [ 1040.564062][ T4986] vfs_write+0x71c/0x890 [ 1040.568369][ T4986] ksys_write+0xe8/0x1a0 [ 1040.572604][ T4986] __x64_sys_write+0x3e/0x50 [ 1040.577189][ T4986] do_syscall_64+0x2b/0x70 [ 1040.581617][ T4986] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1040.587501][ T4986] RIP: 0033:0x7f66d72200e9 [ 1040.591898][ T4986] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1040.611528][ T4986] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1040.619925][ T4986] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1040.627880][ T4986] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1040.635838][ T4986] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1040.643863][ T4986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1040.651870][ T4986] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1040.659832][ T4986] [ 1040.662838][ T4994] CPU: 1 PID: 4994 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1040.673877][ T4994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1040.683928][ T4994] Call Trace: [ 1040.687259][ T4994] [ 1040.690216][ T4994] dump_stack_lvl+0xd6/0x122 [ 1040.694886][ T4994] dump_stack+0x11/0x12 [ 1040.699045][ T4994] should_fail+0x230/0x240 [ 1040.703479][ T4994] __alloc_pages+0xf0/0x320 [ 1040.707992][ T4994] alloc_pages_vma+0x66d/0x7e0 [ 1040.712810][ T4994] ? __this_cpu_preempt_check+0xf/0x10 [ 1040.718370][ T4994] shmem_alloc_and_acct_page+0x219/0x580 [ 1040.724161][ T4994] shmem_getpage_gfp+0x300/0x16c0 [ 1040.729210][ T4994] shmem_write_begin+0x84/0x110 [ 1040.734071][ T4994] generic_perform_write+0x1d6/0x3f0 [ 1040.739377][ T4994] ? shmem_write_begin+0x110/0x110 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 29) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RSYMLINK(r1, &(0x7f0000000200)={0x14, 0x11, 0x2, {0x2, 0x4}}, 0x14) (async) write$P9_RXATTRWALK(r0, &(0x7f00000001c0)={0xf, 0x1f, 0x2, 0x9f}, 0xf) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000003c07a7065b70bc9aa5f0000000000000000000000000000000000000000000000000000000000000000ffff94bdc70b54d8d12be3bc28728dea7a03b488a2eb1256d8f414ac50a9365742c8c962e3f4642875400781581b0a528ee39b9c4546a72f447ab14ba6988d6cff37ceae45558f559e2e37949a5228167afcb7ce04e732a5bb3430a90f12e2a809cbb55062149704071e9dfd1b73c1b6ed3bfdd239160a2dadf8d799a4f6b9e150209387522a1890c243cffb5ce5756cd6e96047fb509eebf6439d232d554485d56f7410fcc60d4ea21ac855e050f8b860e178ff0b0983286cfc51093e769956fb861a1a1e56e336acb24c33", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08f090fd000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r2, 0x80000000) 20:04:03 executing program 3: syz_io_uring_setup(0x144f, &(0x7f0000000000)={0x0, 0x40f7, 0x20, 0x2, 0x22d}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) [ 1040.744526][ T4994] __generic_file_write_iter+0xe3/0x280 [ 1040.750156][ T4994] ? generic_write_checks+0x256/0x290 [ 1040.755593][ T4994] generic_file_write_iter+0x75/0x130 [ 1040.761113][ T4994] vfs_write+0x71c/0x890 [ 1040.765473][ T4994] ksys_write+0xe8/0x1a0 [ 1040.769723][ T4994] __x64_sys_write+0x3e/0x50 [ 1040.774303][ T4994] do_syscall_64+0x2b/0x70 [ 1040.778705][ T4994] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1040.784649][ T4994] RIP: 0033:0x7f2a5a8c30e9 [ 1040.789043][ T4994] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1040.808651][ T4994] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1040.817179][ T4994] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1040.825133][ T4994] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1040.833089][ T4994] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 20:04:03 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 7) 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 3: syz_io_uring_setup(0x144f, &(0x7f0000000000)={0x0, 0x40f7, 0x20, 0x2, 0x22d}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 20:04:03 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = socket$packet(0x11, 0x3, 0x300) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000000)='+\x00', 0x0, r1) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:03 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1040.841054][ T4994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.849045][ T4994] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1040.856997][ T4994] [ 1040.864332][ T5025] FAULT_INJECTION: forcing a failure. [ 1040.864332][ T5025] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1040.877522][ T5025] CPU: 0 PID: 5025 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1040.888897][ T5025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1040.898955][ T5025] Call Trace: [ 1040.900277][ T5033] FAULT_INJECTION: forcing a failure. [ 1040.900277][ T5033] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1040.902235][ T5025] [ 1040.902243][ T5025] dump_stack_lvl+0xd6/0x122 [ 1040.923065][ T5025] dump_stack+0x11/0x12 [ 1040.927223][ T5025] should_fail+0x230/0x240 [ 1040.931707][ T5025] should_fail_usercopy+0x16/0x20 [ 1040.936722][ T5025] copy_page_from_iter_atomic+0x3de/0xb80 [ 1040.942468][ T5025] ? shmem_write_begin+0x84/0x110 [ 1040.947517][ T5025] generic_perform_write+0x21a/0x3f0 [ 1040.952861][ T5025] ? shmem_write_begin+0x110/0x110 [ 1040.957975][ T5025] __generic_file_write_iter+0xe3/0x280 [ 1040.963614][ T5025] ? generic_write_checks+0x256/0x290 [ 1040.969071][ T5025] generic_file_write_iter+0x75/0x130 [ 1040.974454][ T5025] vfs_write+0x71c/0x890 [ 1040.978717][ T5025] ksys_write+0xe8/0x1a0 [ 1040.982951][ T5025] __x64_sys_write+0x3e/0x50 [ 1040.987612][ T5025] do_syscall_64+0x2b/0x70 [ 1040.992030][ T5025] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1040.997912][ T5025] RIP: 0033:0x7f66d72200e9 [ 1041.002312][ T5025] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1041.021972][ T5025] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1041.030368][ T5025] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1041.038323][ T5025] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1041.046277][ T5025] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1041.054239][ T5025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1041.062263][ T5025] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1041.070223][ T5025] [ 1041.073228][ T5033] CPU: 1 PID: 5033 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1041.084167][ T5033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 30) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 3: syz_io_uring_setup(0x144f, &(0x7f0000000000)={0x0, 0x40f7, 0x20, 0x2, 0x22d}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) [ 1041.094227][ T5033] Call Trace: [ 1041.097503][ T5033] [ 1041.100473][ T5033] dump_stack_lvl+0xd6/0x122 [ 1041.105074][ T5033] dump_stack+0x11/0x12 [ 1041.109232][ T5033] should_fail+0x230/0x240 [ 1041.113666][ T5033] __alloc_pages+0xf0/0x320 [ 1041.118178][ T5033] alloc_pages_vma+0x66d/0x7e0 [ 1041.123011][ T5033] ? __this_cpu_preempt_check+0xf/0x10 [ 1041.128473][ T5033] shmem_alloc_and_acct_page+0x219/0x580 [ 1041.133804][ T5044] FAULT_INJECTION: forcing a failure. [ 1041.133804][ T5044] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1041.134119][ T5033] shmem_getpage_gfp+0x300/0x16c0 [ 1041.152204][ T5033] shmem_write_begin+0x84/0x110 [ 1041.157140][ T5033] generic_perform_write+0x1d6/0x3f0 [ 1041.162419][ T5033] ? shmem_write_begin+0x110/0x110 [ 1041.167689][ T5033] __generic_file_write_iter+0xe3/0x280 [ 1041.173221][ T5033] ? generic_write_checks+0x256/0x290 [ 1041.178580][ T5033] generic_file_write_iter+0x75/0x130 [ 1041.183941][ T5033] vfs_write+0x71c/0x890 [ 1041.188177][ T5033] ksys_write+0xe8/0x1a0 [ 1041.192423][ T5033] __x64_sys_write+0x3e/0x50 [ 1041.197075][ T5033] do_syscall_64+0x2b/0x70 [ 1041.201510][ T5033] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1041.207391][ T5033] RIP: 0033:0x7f2a5a8c30e9 [ 1041.211797][ T5033] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1041.231564][ T5033] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1041.239969][ T5033] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1041.248175][ T5033] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1041.256153][ T5033] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1041.264118][ T5033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1041.272081][ T5033] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1041.280057][ T5033] [ 1041.283063][ T5044] CPU: 0 PID: 5044 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 20:04:03 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 8) 20:04:03 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x0, 0x3, 0x2, 0x8}, {0x401, 0x8, 0x5, 0x9}, {0x1, 0x20, 0x8, 0x8001}, {0x80, 0xec, 0xb5, 0x1000}, {0x1, 0x6c, 0x7, 0x49a}, {0x5, 0x4, 0x4d, 0xffffffff}, {0xfffe, 0x7, 0x7f, 0x8000}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1041.294076][ T5044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1041.304131][ T5044] Call Trace: [ 1041.307409][ T5044] [ 1041.310355][ T5044] dump_stack_lvl+0xd6/0x122 [ 1041.314972][ T5044] dump_stack+0x11/0x12 [ 1041.319264][ T5044] should_fail+0x230/0x240 [ 1041.323751][ T5044] should_fail_usercopy+0x16/0x20 [ 1041.328779][ T5044] copy_page_from_iter_atomic+0x3de/0xb80 [ 1041.334580][ T5044] ? shmem_write_begin+0x84/0x110 [ 1041.339612][ T5044] generic_perform_write+0x21a/0x3f0 20:04:03 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1041.344907][ T5044] ? shmem_write_begin+0x110/0x110 [ 1041.350037][ T5044] __generic_file_write_iter+0xe3/0x280 [ 1041.355589][ T5044] ? generic_write_checks+0x256/0x290 [ 1041.360973][ T5044] generic_file_write_iter+0x75/0x130 [ 1041.366358][ T5044] vfs_write+0x71c/0x890 [ 1041.370617][ T5044] ksys_write+0xe8/0x1a0 [ 1041.374886][ T5044] __x64_sys_write+0x3e/0x50 [ 1041.379608][ T5044] do_syscall_64+0x2b/0x70 [ 1041.382778][ T5055] FAULT_INJECTION: forcing a failure. [ 1041.382778][ T5055] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1041.384032][ T5044] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1041.384066][ T5044] RIP: 0033:0x7f66d72200e9 [ 1041.407526][ T5044] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1041.427190][ T5044] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1041.435597][ T5044] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1041.443568][ T5044] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1041.451528][ T5044] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1041.459581][ T5044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1041.467538][ T5044] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1041.475591][ T5044] [ 1041.478596][ T5055] CPU: 1 PID: 5055 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 20:04:03 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = socket$packet(0x11, 0x3, 0x300) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000000)='+\x00', 0x0, r1) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:03 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x0, 0x3, 0x2, 0x8}, {0x401, 0x8, 0x5, 0x9}, {0x1, 0x20, 0x8, 0x8001}, {0x80, 0xec, 0xb5, 0x1000}, {0x1, 0x6c, 0x7, 0x49a}, {0x5, 0x4, 0x4d, 0xffffffff}, {0xfffe, 0x7, 0x7f, 0x8000}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) 20:04:03 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:03 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 31) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1041.489538][ T5055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1041.499590][ T5055] Call Trace: [ 1041.502864][ T5055] [ 1041.505798][ T5055] dump_stack_lvl+0xd6/0x122 [ 1041.510412][ T5055] dump_stack+0x11/0x12 [ 1041.514717][ T5055] should_fail+0x230/0x240 [ 1041.519175][ T5055] should_fail_usercopy+0x16/0x20 [ 1041.524246][ T5055] copy_page_from_iter_atomic+0x3de/0xb80 [ 1041.530007][ T5055] ? shmem_write_begin+0x84/0x110 [ 1041.535125][ T5055] generic_perform_write+0x21a/0x3f0 [ 1041.540422][ T5055] ? shmem_write_begin+0x110/0x110 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1041.545580][ T5055] __generic_file_write_iter+0xe3/0x280 [ 1041.551133][ T5055] ? generic_write_checks+0x256/0x290 [ 1041.556535][ T5055] generic_file_write_iter+0x75/0x130 [ 1041.561911][ T5055] vfs_write+0x71c/0x890 [ 1041.566242][ T5055] ksys_write+0xe8/0x1a0 [ 1041.570577][ T5055] __x64_sys_write+0x3e/0x50 [ 1041.575209][ T5055] do_syscall_64+0x2b/0x70 [ 1041.579629][ T5055] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1041.585589][ T5055] RIP: 0033:0x7f2a5a8c30e9 [ 1041.585767][ T5073] FAULT_INJECTION: forcing a failure. [ 1041.585767][ T5073] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1041.590054][ T5055] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1041.590075][ T5055] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1041.631151][ T5055] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1041.639108][ T5055] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1041.647146][ T5055] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1041.655105][ T5055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1041.663067][ T5055] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 [ 1041.671040][ T5055] [ 1041.674043][ T5073] CPU: 0 PID: 5073 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1041.685001][ T5073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1041.695071][ T5073] Call Trace: [ 1041.698373][ T5073] [ 1041.701465][ T5073] dump_stack_lvl+0xd6/0x122 [ 1041.704380][ T5081] FAULT_INJECTION: forcing a failure. [ 1041.704380][ T5081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1041.706377][ T5073] dump_stack+0x11/0x12 [ 1041.706405][ T5073] should_fail+0x230/0x240 [ 1041.728032][ T5073] should_fail_usercopy+0x16/0x20 [ 1041.733114][ T5073] copy_page_from_iter_atomic+0x3de/0xb80 [ 1041.738935][ T5073] ? shmem_write_begin+0x84/0x110 [ 1041.744016][ T5073] generic_perform_write+0x21a/0x3f0 [ 1041.749292][ T5073] ? shmem_write_begin+0x110/0x110 [ 1041.754418][ T5073] __generic_file_write_iter+0xe3/0x280 [ 1041.759978][ T5073] ? generic_write_checks+0x256/0x290 [ 1041.765333][ T5073] generic_file_write_iter+0x75/0x130 [ 1041.770730][ T5073] vfs_write+0x71c/0x890 [ 1041.775045][ T5073] ksys_write+0xe8/0x1a0 [ 1041.779343][ T5073] __x64_sys_write+0x3e/0x50 [ 1041.783999][ T5073] do_syscall_64+0x2b/0x70 [ 1041.788410][ T5073] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1041.794290][ T5073] RIP: 0033:0x7f66d72200e9 [ 1041.798697][ T5073] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1041.818305][ T5073] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1041.826821][ T5073] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1041.834780][ T5073] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 20:04:04 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 9) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x0, 0x3, 0x2, 0x8}, {0x401, 0x8, 0x5, 0x9}, {0x1, 0x20, 0x8, 0x8001}, {0x80, 0xec, 0xb5, 0x1000}, {0x1, 0x6c, 0x7, 0x49a}, {0x5, 0x4, 0x4d, 0xffffffff}, {0xfffe, 0x7, 0x7f, 0x8000}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000080)) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) [ 1041.842739][ T5073] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1041.850695][ T5073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1041.858696][ T5073] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1041.866655][ T5073] [ 1041.869660][ T5081] CPU: 1 PID: 5081 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1041.880755][ T5081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1041.890815][ T5081] Call Trace: [ 1041.894096][ T5081] [ 1041.897029][ T5081] dump_stack_lvl+0xd6/0x122 [ 1041.901632][ T5081] dump_stack+0x11/0x12 [ 1041.905809][ T5081] should_fail+0x230/0x240 [ 1041.910228][ T5081] should_fail_usercopy+0x16/0x20 [ 1041.915374][ T5081] copy_page_from_iter_atomic+0x3de/0xb80 [ 1041.921099][ T5081] ? shmem_write_begin+0x84/0x110 [ 1041.926135][ T5081] generic_perform_write+0x21a/0x3f0 [ 1041.931427][ T5081] ? shmem_write_begin+0x110/0x110 [ 1041.936544][ T5081] __generic_file_write_iter+0xe3/0x280 [ 1041.942186][ T5081] ? generic_write_checks+0x256/0x290 [ 1041.947556][ T5081] generic_file_write_iter+0x75/0x130 [ 1041.952906][ T5081] vfs_write+0x71c/0x890 [ 1041.957195][ T5081] ksys_write+0xe8/0x1a0 [ 1041.961423][ T5081] __x64_sys_write+0x3e/0x50 [ 1041.966013][ T5081] do_syscall_64+0x2b/0x70 [ 1041.970455][ T5081] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1041.976342][ T5081] RIP: 0033:0x7f2a5a8c30e9 [ 1041.980775][ T5081] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1042.000395][ T5081] RSP: 002b:00007f2a5a039168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1042.008787][ T5081] RAX: ffffffffffffffda RBX: 00007f2a5a9d5f60 RCX: 00007f2a5a8c30e9 [ 1042.016807][ T5081] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000003 [ 1042.024757][ T5081] RBP: 00007f2a5a0391d0 R08: 0000000000000000 R09: 0000000000000000 [ 1042.032710][ T5081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1042.040659][ T5081] R13: 00007fff192bba6f R14: 00007f2a5a039300 R15: 0000000000022000 20:04:04 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = socket$packet(0x11, 0x3, 0x300) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000000)='+\x00', 0x0, r1) write$P9_RREADDIR(r0, 0x0, 0xffcb) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) socket$packet(0x11, 0x3, 0x300) (async) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000000)='+\x00', 0x0, r1) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010002000000000000000c000000080005004f0c00000c20028006000f000000000008000600710c0000"], 0x30}}, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00050002010000000000004c68bcdb071758a7f91a17a515b0c8a6909bc6e42abab11893d6e5fc370e516d623a0e48d2af47127c8a81f0a77fac1f7b1eb7728ad109e1294115c85a2df7951f360b7c2728feff639aa8740bd2b6547cc77e878dfae2aefc43be4a414654d7d71e757aa8134a367f01906978044cfe4a3f26916ea87440553ff943f6983e7d8a79219d1397d91076776e9cef150fb7d635336d522c770f0276907c4cd5879d1d7c5d408f4d461416b11e4fa496deb4e8aff0e93d77a897cb1d6f8b5921dcd208477ab36dc258bf2415b00c3ee7fb1168f3bcd53152cd7a9e2d8d77e9f4aa424b6e27b874fafffd60667e764b30c08086ca7264081fdff56957081fb6b6158835846f1926714798339d475a954a98f280084442e479c930c09cc8995a13328af5990b7668d22acacbbaa546f41ec49b000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4001400}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x114, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x64, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x40, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfa70}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3b29}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x79}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x40}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}]}, 0x114}, 0x1, 0x0, 0x0, 0x100}, 0x8800) 20:04:04 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 32) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (fail_nth: 10) [ 1042.048619][ T5081] 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010002000000000000000c000000080005004f0c00000c20028006000f000000000008000600710c0000"], 0x30}}, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00050002010000000000004c68bcdb071758a7f91a17a515b0c8a6909bc6e42abab11893d6e5fc370e516d623a0e48d2af47127c8a81f0a77fac1f7b1eb7728ad109e1294115c85a2df7951f360b7c2728feff639aa8740bd2b6547cc77e878dfae2aefc43be4a414654d7d71e757aa8134a367f01906978044cfe4a3f26916ea87440553ff943f6983e7d8a79219d1397d91076776e9cef150fb7d635336d522c770f0276907c4cd5879d1d7c5d408f4d461416b11e4fa496deb4e8aff0e93d77a897cb1d6f8b5921dcd208477ab36dc258bf2415b00c3ee7fb1168f3bcd53152cd7a9e2d8d77e9f4aa424b6e27b874fafffd60667e764b30c08086ca7264081fdff56957081fb6b6158835846f1926714798339d475a954a98f280084442e479c930c09cc8995a13328af5990b7668d22acacbbaa546f41ec49b000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4001400}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x114, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x64, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x40, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfa70}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3b29}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x79}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x40}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}]}, 0x114}, 0x1, 0x0, 0x0, 0x100}, 0x8800) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010002000000000000000c000000080005004f0c00000c20028006000f000000000008000600710c0000"], 0x30}}, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00050002010000000000004c68bcdb071758a7f91a17a515b0c8a6909bc6e42abab11893d6e5fc370e516d623a0e48d2af47127c8a81f0a77fac1f7b1eb7728ad109e1294115c85a2df7951f360b7c2728feff639aa8740bd2b6547cc77e878dfae2aefc43be4a414654d7d71e757aa8134a367f01906978044cfe4a3f26916ea87440553ff943f6983e7d8a79219d1397d91076776e9cef150fb7d635336d522c770f0276907c4cd5879d1d7c5d408f4d461416b11e4fa496deb4e8aff0e93d77a897cb1d6f8b5921dcd208477ab36dc258bf2415b00c3ee7fb1168f3bcd53152cd7a9e2d8d77e9f4aa424b6e27b874fafffd60667e764b30c08086ca7264081fdff56957081fb6b6158835846f1926714798339d475a954a98f280084442e479c930c09cc8995a13328af5990b7668d22acacbbaa546f41ec49b000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4001400}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x114, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x64, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x40, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfa70}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3b29}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x79}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x40}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}]}, 0x114}, 0x1, 0x0, 0x0, 0x100}, 0x8800) (async) [ 1042.076483][ T5097] FAULT_INJECTION: forcing a failure. [ 1042.076483][ T5097] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1042.089761][ T5097] CPU: 1 PID: 5097 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1042.100784][ T5097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1042.110929][ T5097] Call Trace: [ 1042.114213][ T5097] [ 1042.117146][ T5097] dump_stack_lvl+0xd6/0x122 [ 1042.121782][ T5097] dump_stack+0x11/0x12 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1042.126078][ T5097] should_fail+0x230/0x240 [ 1042.130503][ T5097] __alloc_pages+0xf0/0x320 [ 1042.135012][ T5097] alloc_pages_vma+0x66d/0x7e0 [ 1042.139819][ T5097] ? __this_cpu_preempt_check+0xf/0x10 [ 1042.145416][ T5097] shmem_alloc_and_acct_page+0x219/0x580 [ 1042.151208][ T5097] shmem_getpage_gfp+0x300/0x16c0 [ 1042.156243][ T5097] shmem_write_begin+0x84/0x110 [ 1042.161198][ T5097] generic_perform_write+0x1d6/0x3f0 [ 1042.166486][ T5097] ? shmem_write_begin+0x110/0x110 [ 1042.171630][ T5097] __generic_file_write_iter+0xe3/0x280 [ 1042.177195][ T5097] ? generic_write_checks+0x256/0x290 [ 1042.182596][ T5097] generic_file_write_iter+0x75/0x130 [ 1042.187956][ T5097] vfs_write+0x71c/0x890 [ 1042.192206][ T5097] ksys_write+0xe8/0x1a0 [ 1042.196435][ T5097] __x64_sys_write+0x3e/0x50 [ 1042.201117][ T5097] do_syscall_64+0x2b/0x70 [ 1042.205587][ T5097] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1042.211558][ T5097] RIP: 0033:0x7f66d72200e9 [ 1042.215959][ T5097] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1042.235567][ T5097] RSP: 002b:00007f66d6996168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1042.244051][ T5097] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d72200e9 [ 1042.252017][ T5097] RDX: 000000000000ffcb RSI: 00000000200005c0 RDI: 0000000000000004 [ 1042.259974][ T5097] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 [ 1042.268094][ T5097] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 20:04:04 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (fail_nth: 33) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010002000000000000000c000000080005004f0c00000c20028006000f000000000008000600710c0000"], 0x30}}, 0x0) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00050002010000000000004c68bcdb071758a7f91a17a515b0c8a6909bc6e42abab11893d6e5fc370e516d623a0e48d2af47127c8a81f0a77fac1f7b1eb7728ad109e1294115c85a2df7951f360b7c2728feff639aa8740bd2b6547cc77e878dfae2aefc43be4a414654d7d71e757aa8134a367f01906978044cfe4a3f26916ea87440553ff943f6983e7d8a79219d1397d91076776e9cef150fb7d635336d522c770f0276907c4cd5879d1d7c5d408f4d461416b11e4fa496deb4e8aff0e93d77a897cb1d6f8b5921dcd208477ab36dc258bf2415b00c3ee7fb1168f3bcd53152cd7a9e2d8d77e9f4aa424b6e27b874fafffd60667e764b30c08086ca7264081fdff56957081fb6b6158835846f1926714798339d475a954a98f280084442e479c930c09cc8995a13328af5990b7668d22acacbbaa546f41ec49b000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4001400}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x114, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x64, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x40, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfa70}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3b29}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x79}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x40}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}]}, 0x114}, 0x1, 0x0, 0x0, 0x100}, 0x8800) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010002000000000000000c000000080005004f0c00000c20028006000f000000000008000600710c0000"], 0x30}}, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00050002010000000000004c68bcdb071758a7f91a17a515b0c8a6909bc6e42abab11893d6e5fc370e516d623a0e48d2af47127c8a81f0a77fac1f7b1eb7728ad109e1294115c85a2df7951f360b7c2728feff639aa8740bd2b6547cc77e878dfae2aefc43be4a414654d7d71e757aa8134a367f01906978044cfe4a3f26916ea87440553ff943f6983e7d8a79219d1397d91076776e9cef150fb7d635336d522c770f0276907c4cd5879d1d7c5d408f4d461416b11e4fa496deb4e8aff0e93d77a897cb1d6f8b5921dcd208477ab36dc258bf2415b00c3ee7fb1168f3bcd53152cd7a9e2d8d77e9f4aa424b6e27b874fafffd60667e764b30c08086ca7264081fdff56957081fb6b6158835846f1926714798339d475a954a98f280084442e479c930c09cc8995a13328af5990b7668d22acacbbaa546f41ec49b000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4001400}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x114, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x64, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x40, 0x20}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfa70}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3b29}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x79}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x40}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}]}, 0x114}, 0x1, 0x0, 0x0, 0x100}, 0x8800) (async) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 0: timer_gettime(0x0, &(0x7f0000000000)) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x3c, 0x1, @thr={&(0x7f0000000040)="36a36695cb1c889bc2ab36fe1a1d4bec34047d498d7a", &(0x7f0000000080)="b50cca83c56c"}}, &(0x7f0000000100)=0x0) timer_gettime(r1, &(0x7f0000000140)) write$P9_RREADDIR(r0, 0x0, 0xffcb) [ 1042.276275][ T5097] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1042.284236][ T5097] [ 1042.311699][ T5125] FAULT_INJECTION: forcing a failure. [ 1042.311699][ T5125] name fail_usercopy, interval 1, probability 0, space 0, times 0 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x4, &(0x7f0000ffd000/0x3000)=nil) 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f0000ffc000/0x4000)=nil) (async, rerun: 64) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x4, &(0x7f0000ffd000/0x3000)=nil) (rerun: 64) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x400001, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x6a) [ 1042.324863][ T5125] CPU: 1 PID: 5125 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1042.335848][ T5125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1042.345911][ T5125] Call Trace: [ 1042.349194][ T5125] [ 1042.352122][ T5125] dump_stack_lvl+0xd6/0x122 [ 1042.356723][ T5125] dump_stack+0x11/0x12 [ 1042.360912][ T5125] should_fail+0x230/0x240 [ 1042.365339][ T5125] should_fail_usercopy+0x16/0x20 [ 1042.370415][ T5125] _copy_to_user+0x1a/0x90 20:04:04 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x106a) [ 1042.374852][ T5125] simple_read_from_buffer+0xab/0x120 [ 1042.380312][ T5125] proc_fail_nth_read+0x10d/0x150 [ 1042.385346][ T5125] ? proc_fault_inject_write+0x230/0x230 [ 1042.390991][ T5125] vfs_read+0x1a1/0x6a0 [ 1042.395239][ T5125] ? __fget_files+0x1d2/0x210 [ 1042.399922][ T5125] ksys_read+0xe8/0x1a0 [ 1042.404138][ T5125] __x64_sys_read+0x3e/0x50 [ 1042.408770][ T5125] do_syscall_64+0x2b/0x70 [ 1042.413303][ T5125] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1042.419201][ T5125] RIP: 0033:0x7f66d71d2c9c [ 1042.423630][ T5125] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1042.443688][ T5125] RSP: 002b:00007f66d6996160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1042.452082][ T5125] RAX: ffffffffffffffda RBX: 00007f66d7332f60 RCX: 00007f66d71d2c9c [ 1042.460292][ T5125] RDX: 000000000000000f RSI: 00007f66d69961e0 RDI: 0000000000000005 [ 1042.468320][ T5125] RBP: 00007f66d69961d0 R08: 0000000000000000 R09: 0000000000000000 20:04:04 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x4, &(0x7f0000ffd000/0x3000)=nil) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f0000ffc000/0x4000)=nil) (async) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x4, &(0x7f0000ffd000/0x3000)=nil) (async) 20:04:04 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x206a) 20:04:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1004000, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:04 executing program 0: timer_gettime(0x0, &(0x7f0000000000)) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x3c, 0x1, @thr={&(0x7f0000000040)="36a36695cb1c889bc2ab36fe1a1d4bec34047d498d7a", &(0x7f0000000080)="b50cca83c56c"}}, &(0x7f0000000100)=0x0) timer_gettime(r1, &(0x7f0000000140)) (async, rerun: 64) write$P9_RREADDIR(r0, 0x0, 0xffcb) (rerun: 64) 20:04:04 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffa000/0x3000)=nil) 20:04:04 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x35) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:04 executing program 0: timer_gettime(0x0, &(0x7f0000000000)) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x3c, 0x1, @thr={&(0x7f0000000040)="36a36695cb1c889bc2ab36fe1a1d4bec34047d498d7a", &(0x7f0000000080)="b50cca83c56c"}}, &(0x7f0000000100)=0x0) timer_gettime(r1, &(0x7f0000000140)) write$P9_RREADDIR(r0, 0x0, 0xffcb) timer_gettime(0x0, &(0x7f0000000000)) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x3c, 0x1, @thr={&(0x7f0000000040)="36a36695cb1c889bc2ab36fe1a1d4bec34047d498d7a", &(0x7f0000000080)="b50cca83c56c"}}, &(0x7f0000000100)) (async) timer_gettime(r1, &(0x7f0000000140)) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x306a) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffa000/0x3000)=nil) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffa000/0x3000)=nil) (async) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1042.476378][ T5125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1042.484337][ T5125] R13: 00007ffdf36ca7ef R14: 00007f66d6996300 R15: 0000000000022000 [ 1042.492311][ T5125] 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x1035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: mmap$qrtrtun(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x10010, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x9, 0x1292c0) getsockname$tipc(r0, &(0x7f0000000040), &(0x7f0000000080)=0x10) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121c02) socket$inet_udp(0x2, 0x2, 0x0) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x406a) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffa000/0x3000)=nil) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0xffff0000, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x2035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x506a) 20:04:05 executing program 0: mmap$qrtrtun(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x10010, 0xffffffffffffffff, 0x0) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x9, 0x1292c0) getsockname$tipc(r0, &(0x7f0000000040), &(0x7f0000000080)=0x10) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121c02) socket$inet_udp(0x2, 0x2, 0x0) (async) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:04:05 executing program 3: madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x13) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x50, 0xffffffffffffffff, 0x100000000) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x3035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x606a) 20:04:05 executing program 0: mmap$qrtrtun(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x10010, 0xffffffffffffffff, 0x0) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x9, 0x1292c0) getsockname$tipc(r0, &(0x7f0000000040), &(0x7f0000000080)=0x10) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121c02) (async) socket$inet_udp(0x2, 0x2, 0x0) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:04:05 executing program 3: madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x13) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x50, 0xffffffffffffffff, 0x100000000) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x706a) 20:04:05 executing program 0: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000140)={0xf, 0x1f, 0x2}, 0xf) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x4}, @NLBL_CIPSOV4_A_MLSLVLLST={0x18, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x85}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x41}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x34, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x45}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61db624}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x551ab29c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61e41c28}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x31}]}]}]}, 0x68}}, 0x80) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x4035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400001, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x13) (async) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x50, 0xffffffffffffffff, 0x100000000) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x806a) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000140)={0xf, 0x1f, 0x2}, 0xf) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x4}, @NLBL_CIPSOV4_A_MLSLVLLST={0x18, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x85}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x41}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x34, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x45}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61db624}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x551ab29c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61e41c28}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x31}]}]}]}, 0x68}}, 0x80) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000140)={0xf, 0x1f, 0x2}, 0xf) (async) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x4}, @NLBL_CIPSOV4_A_MLSLVLLST={0x18, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x85}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x41}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x34, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x45}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61db624}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x551ab29c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61e41c28}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x31}]}]}]}, 0x68}}, 0x80) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) 20:04:05 executing program 3: munmap(&(0x7f0000fff000/0x1000)=nil, 0x1000) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x5035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x906a) 20:04:05 executing program 3: munmap(&(0x7f0000fff000/0x1000)=nil, 0x1000) munmap(&(0x7f0000fff000/0x1000)=nil, 0x1000) (async) 20:04:05 executing program 0: write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000140)={0xf, 0x1f, 0x2}, 0xf) (async) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x4}, @NLBL_CIPSOV4_A_MLSLVLLST={0x18, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x85}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x41}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x34, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x45}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61db624}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x551ab29c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61e41c28}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x31}]}]}]}, 0x68}}, 0x80) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xa06a) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x6035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 3: munmap(&(0x7f0000fff000/0x1000)=nil, 0x1000) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000180)={0x1, 0x10, 0xfa00, {&(0x7f0000000140)}}, 0x18) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x9, 0x422880) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000427bd7000fedbdf250100000014001f000000000000000037300000000000000106000e0036000000"], 0x30}, 0x1, 0x0, 0x0, 0x20048805}, 0x4000040) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xb06a) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0x0, 0x80080) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0x4, r1, 0x0, 0x0, 0x1}}, 0x20) fsmount(r0, 0x1, 0x87) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x7035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xc06a) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x8035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000180)={0x1, 0x10, 0xfa00, {&(0x7f0000000140)}}, 0x18) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x9, 0x422880) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000427bd7000fedbdf250100000014001f000000000000000037300000000000000106000e0036000000"], 0x30}, 0x1, 0x0, 0x0, 0x20048805}, 0x4000040) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async, rerun: 64) r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0x0, 0x80080) (rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0x4, r1, 0x0, 0x0, 0x1}}, 0x20) (async) fsmount(r0, 0x1, 0x87) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xd06a) 20:04:05 executing program 0: write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000180)={0x1, 0x10, 0xfa00, {&(0x7f0000000140)}}, 0x18) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x9, 0x422880) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000427bd7000fedbdf250100000014001f000000000000000037300000000000000106000e0036000000"], 0x30}, 0x1, 0x0, 0x0, 0x20048805}, 0x4000040) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xe06a) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x9035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = accept4$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10, 0x80800) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000080)={0x0, 0x8, 0xd4b}) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0x0, 0x80080) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0x4, r1, 0x0, 0x0, 0x1}}, 0x20) (async) fsmount(r0, 0x1, 0x87) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xa035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xf06a) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = accept4$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10, 0x80800) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000080)={0x0, 0x8, 0xd4b}) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) accept4$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10, 0x80800) (async) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000080)={0x0, 0x8, 0xd4b}) (async) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xfdef) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000006, 0x10, 0xffffffffffffffff, 0x100000000) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x2010, 0xffffffffffffffff, 0xae75079ee56c353d) syz_io_uring_setup(0x43ed, &(0x7f0000000000)={0x0, 0x91ee, 0x1, 0x2, 0x210}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/37, 0x25, 0x0, &(0x7f0000000140)=""/247, 0xf7}, &(0x7f0000000280)=0x40) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x11) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xb035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = accept4$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10, 0x80800) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000080)={0x0, 0x8, 0xd4b}) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000006, 0x10, 0xffffffffffffffff, 0x100000000) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x2010, 0xffffffffffffffff, 0xae75079ee56c353d) syz_io_uring_setup(0x43ed, &(0x7f0000000000)={0x0, 0x91ee, 0x1, 0x2, 0x210}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/37, 0x25, 0x0, &(0x7f0000000140)=""/247, 0xf7}, &(0x7f0000000280)=0x40) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x11) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000006, 0x10, 0xffffffffffffffff, 0x100000000) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x2010, 0xffffffffffffffff, 0xae75079ee56c353d) (async) syz_io_uring_setup(0x43ed, &(0x7f0000000000)={0x0, 0x91ee, 0x1, 0x2, 0x210}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/37, 0x25, 0x0, &(0x7f0000000140)=""/247, 0xf7}, &(0x7f0000000280)=0x40) (async) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x11) (async) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000001000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x9, 0x40) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_open_dev$vcsn(&(0x7f0000000080), 0x8, 0x100040) r4 = fsmount(r0, 0x1, 0xa) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20008008}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x10b}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3f}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r2}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x6, 0xa, '@\\'}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r0}, {0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r6}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xc035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x80eb06a) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x9, 0x40) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r3 = syz_open_dev$vcsn(&(0x7f0000000080), 0x8, 0x100040) r4 = fsmount(r0, 0x1, 0xa) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20008008}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x10b}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3f}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r2}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x6, 0xa, '@\\'}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r0}, {0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r6}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) 20:04:05 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000006, 0x10, 0xffffffffffffffff, 0x100000000) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x2010, 0xffffffffffffffff, 0xae75079ee56c353d) syz_io_uring_setup(0x43ed, &(0x7f0000000000)={0x0, 0x91ee, 0x1, 0x2, 0x210}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/37, 0x25, 0x0, &(0x7f0000000140)=""/247, 0xf7}, &(0x7f0000000280)=0x40) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x11) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000006, 0x10, 0xffffffffffffffff, 0x100000000) (async) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x2010, 0xffffffffffffffff, 0xae75079ee56c353d) (async) syz_io_uring_setup(0x43ed, &(0x7f0000000000)={0x0, 0x91ee, 0x1, 0x2, 0x210}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/37, 0x25, 0x0, &(0x7f0000000140)=""/247, 0xf7}, &(0x7f0000000280)=0x40) (async) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x11) (async) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xd035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000010000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7012a2106f00001c00078045049a99", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000), 0x106, 0x13}}, 0x20) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xe035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000100000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x7ffff000) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xf035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x9, 0x40) (async) r2 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r2, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r3 = syz_open_dev$vcsn(&(0x7f0000000080), 0x8, 0x100040) (async) r4 = fsmount(r0, 0x1, 0xa) (async) r5 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r6 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r6, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20008008}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x10b}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3f}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r2}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x6, 0xa, '@\\'}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r0}, {0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r6}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) 20:04:05 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7012a2106f00001c00078045049a99", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000), 0x106, 0x13}}, 0x20) (async, rerun: 32) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) (rerun: 32) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RRENAMEAT(r1, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) move_pages(0x0, 0x4, &(0x7f0000000080)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil], &(0x7f00000000c0)=[0xb88], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) 20:04:05 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7012a2106f00001c00078045049a99", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000), 0x106, 0x13}}, 0x20) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfdef) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) r2 = fsmount(r0, 0x1, 0x89) r3 = syz_open_dev$vcsn(&(0x7f00000001c0), 0x6db, 0x16000) fsconfig$FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000140)='\x00', &(0x7f0000000180)='./file0\x00', r3) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) syz_io_uring_setup(0x222b, &(0x7f0000000040)={0x0, 0xe12c, 0x10, 0x2, 0x1de, 0x0, r1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4}, 0xc) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x8787035) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xfffffdef) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RRENAMEAT(r1, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) move_pages(0x0, 0x4, &(0x7f0000000080)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil], &(0x7f00000000c0)=[0xb88], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$P9_RRENAMEAT(r1, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) (async) move_pages(0x0, 0x4, &(0x7f0000000080)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil], &(0x7f00000000c0)=[0xb88], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) (async) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff000000000000, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) r2 = fsmount(r0, 0x1, 0x89) (async) r3 = syz_open_dev$vcsn(&(0x7f00000001c0), 0x6db, 0x16000) fsconfig$FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000140)='\x00', &(0x7f0000000180)='./file0\x00', r3) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_io_uring_setup(0x222b, &(0x7f0000000040)={0x0, 0xe12c, 0x10, 0x2, 0x1de, 0x0, r1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4}, 0xc) 20:04:05 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2804, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RRENAMEAT(r1, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) move_pages(0x0, 0x4, &(0x7f0000000080)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil], &(0x7f00000000c0)=[0xb88], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) syz_open_dev$vcsn(&(0x7f0000000000), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$P9_RRENAMEAT(r1, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) (async) move_pages(0x0, 0x4, &(0x7f0000000080)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil], &(0x7f00000000c0)=[0xb88], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) (async) 20:04:05 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x7ffff000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:05 executing program 3: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) r2 = fsmount(r0, 0x1, 0x89) r3 = syz_open_dev$vcsn(&(0x7f00000001c0), 0x6db, 0x16000) fsconfig$FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000140)='\x00', &(0x7f0000000180)='./file0\x00', r3) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 32) syz_io_uring_setup(0x222b, &(0x7f0000000040)={0x0, 0xe12c, 0x10, 0x2, 0x1de, 0x0, r1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (rerun: 32) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4}, 0xc) 20:04:05 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = socket$inet_udp(0x2, 0x2, 0x0) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r2 = syz_open_dev$vcsn(0x0, 0x6, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RLERRORu(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="1200000007010005006c32747000fa050000316997c866e447a51d6fc3d8da56a889400d008e759bbf7375bfa8a3d4f0602e44"], 0x12) write$cgroup_freezer_state(r0, &(0x7f0000000080)='FREEZING\x00', 0x9) getpeername$tipc(r2, &(0x7f0000000200)=@id, &(0x7f0000000240)=0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r3, 0x0, 0x0) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x4007, @fd_index=0x7, 0xffff, 0x4, 0x6, 0x6, 0x1, {0x3}}, 0x81) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000280)={0x0, 0x3}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x80, 0x0, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x40}, @NBD_ATTR_BACKEND_IDENTIFIER={0xe, 0xa, '/dev/vcs#\x00'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xc0000000}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x80}, 0x1, 0x0, 0x0, 0x811}, 0x4000) 20:04:05 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2810, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1043.433954][ T5466] ================================================================== [ 1043.442062][ T5466] BUG: KCSAN: data-race in __percpu_counter_compare / percpu_counter_add_batch [ 1043.451011][ T5466] [ 1043.453462][ T5466] read-write to 0xffff888101070e50 of 8 bytes by task 5447 on cpu 0: [ 1043.461510][ T5466] percpu_counter_add_batch+0x9a/0x110 [ 1043.467068][ T5466] shmem_alloc_and_acct_page+0x188/0x580 [ 1043.472704][ T5466] shmem_getpage_gfp+0x300/0x16c0 [ 1043.477714][ T5466] shmem_write_begin+0x84/0x110 [ 1043.482549][ T5466] generic_perform_write+0x1d6/0x3f0 [ 1043.487811][ T5466] __generic_file_write_iter+0xe3/0x280 [ 1043.493473][ T5466] generic_file_write_iter+0x75/0x130 [ 1043.498933][ T5466] vfs_write+0x71c/0x890 [ 1043.503157][ T5466] ksys_write+0xe8/0x1a0 [ 1043.507551][ T5466] __x64_sys_write+0x3e/0x50 [ 1043.512124][ T5466] do_syscall_64+0x2b/0x70 [ 1043.516533][ T5466] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1043.522445][ T5466] [ 1043.524749][ T5466] read to 0xffff888101070e50 of 8 bytes by task 5466 on cpu 1: [ 1043.532264][ T5466] __percpu_counter_compare+0x27/0x1a0 [ 1043.537704][ T5466] shmem_alloc_and_acct_page+0x115/0x580 [ 1043.543344][ T5466] shmem_getpage_gfp+0x300/0x16c0 [ 1043.548378][ T5466] shmem_write_begin+0x84/0x110 [ 1043.553220][ T5466] generic_perform_write+0x1d6/0x3f0 [ 1043.558576][ T5466] __generic_file_write_iter+0xe3/0x280 [ 1043.564121][ T5466] generic_file_write_iter+0x75/0x130 [ 1043.569481][ T5466] vfs_write+0x71c/0x890 [ 1043.573714][ T5466] ksys_write+0xe8/0x1a0 [ 1043.577940][ T5466] __x64_sys_write+0x3e/0x50 [ 1043.582535][ T5466] do_syscall_64+0x2b/0x70 [ 1043.586961][ T5466] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1043.592837][ T5466] [ 1043.595160][ T5466] value changed: 0x0000000000005522 -> 0x0000000000005542 [ 1043.602243][ T5466] [ 1043.604549][ T5466] Reported by Kernel Concurrency Sanitizer on: [ 1043.610675][ T5466] CPU: 1 PID: 5466 Comm: syz-executor.5 Not tainted 5.18.0-rc2-syzkaller-00219-g028192fea1de-dirty #0 [ 1043.621783][ T5466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x7ffffffff000) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_SET_PATH_EMPTY(0xffffffffffffffff, 0x4, &(0x7f0000000000)='$&#]+\x00', &(0x7f0000000040)='./file0\x00', r0) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00f22bbd7000ffdbdf25010000000c00020006000000000000001c0007800800010058e3368aa7ec16c49feeef8038a3f8c222f8531fe20cceb631f55260f7085c4508f478cf7d9162d5ed049efd567dad7a2824530a30726beeeb17ba5a6f7a4a3a7eb14bb032a0bfb57709f926231f24c2e88ce1415559de03da9d07fb3f7b4264db13a43d3a407737d562992d26b55063f87d1ed1b00e47bbade09f6f6e0b9516a221a5470c1c88ed55479dd403024c6a6ac7863fd3f0431bdf09970fe9d8a566e7f3c0c712ab640b8fc84db47d90a1118ec87b5134e627b70cd03a0f18c2116d4d5281006088738554db69349994e2e028fe5d76f26045a1fc215ea752d47ba14f17", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockname$tipc(r1, &(0x7f00000000c0)=@id, &(0x7f0000000100)=0x10) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000080)='$&#]+\x00', 0x0, r0) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0x7fffffffff8eb069) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1043.631834][ T5466] ================================================================== 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfffffdef) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsconfig$FSCONFIG_SET_PATH_EMPTY(0xffffffffffffffff, 0x4, &(0x7f0000000000)='$&#]+\x00', &(0x7f0000000040)='./file0\x00', r0) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00f22bbd7000ffdbdf25010000000c00020006000000000000001c0007800800010058e3368aa7ec16c49feeef8038a3f8c222f8531fe20cceb631f55260f7085c4508f478cf7d9162d5ed049efd567dad7a2824530a30726beeeb17ba5a6f7a4a3a7eb14bb032a0bfb57709f926231f24c2e88ce1415559de03da9d07fb3f7b4264db13a43d3a407737d562992d26b55063f87d1ed1b00e47bbade09f6f6e0b9516a221a5470c1c88ed55479dd403024c6a6ac7863fd3f0431bdf09970fe9d8a566e7f3c0c712ab640b8fc84db47d90a1118ec87b5134e627b70cd03a0f18c2116d4d5281006088738554db69349994e2e028fe5d76f26045a1fc215ea752d47ba14f17", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockname$tipc(r1, &(0x7f00000000c0)=@id, &(0x7f0000000100)=0x10) (async) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000080)='$&#]+\x00', 0x0, r0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x400001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = socket$inet_udp(0x2, 0x2, 0x0) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r2 = syz_open_dev$vcsn(0x0, 0x6, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RLERRORu(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="1200000007010005006c32747000fa050000316997c866e447a51d6fc3d8da56a889400d008e759bbf7375bfa8a3d4f0602e44"], 0x12) write$cgroup_freezer_state(r0, &(0x7f0000000080)='FREEZING\x00', 0x9) getpeername$tipc(r2, &(0x7f0000000200)=@id, &(0x7f0000000240)=0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r3, 0x0, 0x0) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x4007, @fd_index=0x7, 0xffff, 0x4, 0x6, 0x6, 0x1, {0x3}}, 0x81) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000280)={0x0, 0x3}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x80, 0x0, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x40}, @NBD_ATTR_BACKEND_IDENTIFIER={0xe, 0xa, '/dev/vcs#\x00'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xc0000000}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x80}, 0x1, 0x0, 0x0, 0x811}, 0x4000) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) syz_open_dev$vcsn(0x0, 0x6, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) write$P9_RLERRORu(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="1200000007010005006c32747000fa050000316997c866e447a51d6fc3d8da56a889400d008e759bbf7375bfa8a3d4f0602e44"], 0x12) (async) write$cgroup_freezer_state(r0, &(0x7f0000000080)='FREEZING\x00', 0x9) (async) getpeername$tipc(r2, &(0x7f0000000200)=@id, &(0x7f0000000240)=0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CIPSOV4_C_LIST(r3, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x4007, @fd_index=0x7, 0xffff, 0x4, 0x6, 0x6, 0x1, {0x3}}, 0x81) (async) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000280)={0x0, 0x3}) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x80, 0x0, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x40}, @NBD_ATTR_BACKEND_IDENTIFIER={0xe, 0xa, '/dev/vcs#\x00'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xc0000000}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x80}, 0x1, 0x0, 0x0, 0x811}, 0x4000) (async) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xfffffffffffffdef) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000000), &(0x7f0000000040)=0x4) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) bind$tipc(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 32) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (rerun: 32) fsconfig$FSCONFIG_SET_PATH_EMPTY(0xffffffffffffffff, 0x4, &(0x7f0000000000)='$&#]+\x00', &(0x7f0000000040)='./file0\x00', r0) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00f22bbd7000ffdbdf25010000000c00020006000000000000001c0007800800010058e3368aa7ec16c49feeef8038a3f8c222f8531fe20cceb631f55260f7085c4508f478cf7d9162d5ed049efd567dad7a2824530a30726beeeb17ba5a6f7a4a3a7eb14bb032a0bfb57709f926231f24c2e88ce1415559de03da9d07fb3f7b4264db13a43d3a407737d562992d26b55063f87d1ed1b00e47bbade09f6f6e0b9516a221a5470c1c88ed55479dd403024c6a6ac7863fd3f0431bdf09970fe9d8a566e7f3c0c712ab640b8fc84db47d90a1118ec87b5134e627b70cd03a0f18c2116d4d5281006088738554db69349994e2e028fe5d76f26045a1fc215ea752d47ba14f17", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c0005000201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) getsockname$tipc(r1, &(0x7f00000000c0)=@id, &(0x7f0000000100)=0x10) (async, rerun: 64) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000080)='$&#]+\x00', 0x0, r0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async, rerun: 32) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) r2 = syz_open_dev$vcsn(0x0, 0x6, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x4, 0x0, 0x0, 0x7}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) write$P9_RLERRORu(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="1200000007010005006c32747000fa050000316997c866e447a51d6fc3d8da56a889400d008e759bbf7375bfa8a3d4f0602e44"], 0x12) (async) write$cgroup_freezer_state(r0, &(0x7f0000000080)='FREEZING\x00', 0x9) (async, rerun: 32) getpeername$tipc(r2, &(0x7f0000000200)=@id, &(0x7f0000000240)=0x10) (rerun: 32) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r3, 0x0, 0x0) (async) r4 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x4007, @fd_index=0x7, 0xffff, 0x4, 0x6, 0x6, 0x1, {0x3}}, 0x81) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000280)={0x0, 0x3}) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x80, 0x0, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x40}, @NBD_ATTR_BACKEND_IDENTIFIER={0xe, 0xa, '/dev/vcs#\x00'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xc0000000}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x80}, 0x1, 0x0, 0x0, 0x811}, 0x4000) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x1004000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x7ffffffff000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000000), &(0x7f0000000040)=0x4) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) (async) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (async) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000040)=[r1, r0, r2, r3, r4]}, 0x5) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x7ffffffffff87034) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000000), &(0x7f0000000040)=0x4) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r3 = socket$xdp(0x2c, 0x3, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000040)=[r1, r0, r2, r3, r4]}, 0x5) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfffffffffffffdef) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="a5"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040), 0x2, 0x4}}, 0x20) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r1, 0x0, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000140)={0x278, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x98, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfd06}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x792478db}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7077}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x47eddb87}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x778}]}, {0x4}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x473ac140}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcd0e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x37af057b}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x790a58fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8cbc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7f2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16a2c7bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3bb4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6dd4}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1c95}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf822}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x150, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26c05e4b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x62740bb6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2eb10bb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaf}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2aab54c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5b}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d97ceca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x34bdd7b6}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc50a694}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef457c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6e2e41a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7cd42668}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5f3cd800}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x13}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x16}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5b98fcf5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x95}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5e0569f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x49}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7887546e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xb2399ad}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9c}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53696dfb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x0, 0x6, 0xb2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6bd4cf1b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7ce183d6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x98}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x3c, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x32499fef}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x16d1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1667ebc9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf322}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x352085a6d795f0e0, 0xa, 0x5cc4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x318a4b8a}]}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x800}, 0x20000004) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1020000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000040)=[r1, r0, r2, r3, r4]}, 0x5) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) socket$xdp(0x2c, 0x3, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000040)=[r1, r0, r2, r3, r4]}, 0x5) (async) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x35}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000811}, 0x4010) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x24004000) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xec, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xf7}]}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7ebe}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x28}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2224}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0xab0b0f8a9ba8b12}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0xec}, 0x1, 0x0, 0x0, 0x4}, 0x40) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r2, 0x4, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xc}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xfd}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x48000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x801}, 0x804) syz_open_dev$usbmon(&(0x7f00000003c0), 0x10001, 0x240080) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x4, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="a5"], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040), 0x2, 0x4}}, 0x20) (rerun: 64) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x10, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x35}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000811}, 0x4010) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x24004000) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xec, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xf7}]}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7ebe}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x28}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2224}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0xab0b0f8a9ba8b12}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0xec}, 0x1, 0x0, 0x0, 0x4}, 0x40) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r2, 0x4, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xc}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xfd}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x48000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x801}, 0x804) syz_open_dev$usbmon(&(0x7f00000003c0), 0x10001, 0x240080) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) (async) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x35}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000811}, 0x4010) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x24004000) (async) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xec, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xf7}]}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7ebe}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x28}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2224}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0xab0b0f8a9ba8b12}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0xec}, 0x1, 0x0, 0x0, 0x4}, 0x40) (async) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r2, 0x4, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xc}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xfd}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x48000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x801}, 0x804) (async) syz_open_dev$usbmon(&(0x7f00000003c0), 0x10001, 0x240080) (async) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r1, 0x0, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000140)={0x278, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x98, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfd06}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x792478db}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7077}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x47eddb87}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x778}]}, {0x4}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x473ac140}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcd0e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x37af057b}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x790a58fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8cbc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7f2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16a2c7bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3bb4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6dd4}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1c95}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf822}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x150, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26c05e4b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x62740bb6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2eb10bb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaf}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2aab54c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5b}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d97ceca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x34bdd7b6}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc50a694}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef457c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6e2e41a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7cd42668}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5f3cd800}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x13}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x16}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5b98fcf5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x95}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5e0569f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x49}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7887546e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xb2399ad}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9c}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53696dfb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x0, 0x6, 0xb2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6bd4cf1b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7ce183d6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x98}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x3c, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x32499fef}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x16d1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1667ebc9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf322}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x352085a6d795f0e0, 0xa, 0x5cc4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x318a4b8a}]}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x800}, 0x20000004) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1020000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040) syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) (async) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CIPSOV4_C_LIST(r1, 0x0, 0x0) (async) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000140)={0x278, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x98, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfd06}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x792478db}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7077}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x47eddb87}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x778}]}, {0x4}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x473ac140}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcd0e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x37af057b}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x790a58fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8cbc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7f2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16a2c7bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3bb4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6dd4}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1c95}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf822}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x150, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26c05e4b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x62740bb6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2eb10bb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaf}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2aab54c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5b}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d97ceca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x34bdd7b6}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc50a694}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef457c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6e2e41a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7cd42668}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5f3cd800}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x13}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x16}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5b98fcf5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x95}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5e0569f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x49}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7887546e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xb2399ad}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9c}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53696dfb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x0, 0x6, 0xb2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6bd4cf1b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7ce183d6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x98}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x3c, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x32499fef}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x16d1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1667ebc9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf322}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x352085a6d795f0e0, 0xa, 0x5cc4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x318a4b8a}]}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x800}, 0x20000004) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1020000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040) (async) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async, rerun: 32) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="a5"], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) (async, rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040), 0x2, 0x4}}, 0x20) (rerun: 64) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x1000001000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x4000000, 0xffffffffffffffff, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="bf8e0b41db3f28ea6d82d77bff020acae42d7fec640c845ed3b169b7f169c722421f835b86c8741d0800"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r1, 0x0, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000140)={0x278, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x98, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfd06}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x792478db}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7077}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x47eddb87}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x778}]}, {0x4}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x473ac140}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcd0e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x37af057b}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x790a58fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8cbc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7f2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16a2c7bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3bb4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6dd4}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1c95}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf822}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x150, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26c05e4b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x62740bb6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2eb10bb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaf}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2aab54c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5b}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d97ceca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x34bdd7b6}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc50a694}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef457c6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6e2e41a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7cd42668}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5f3cd800}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x13}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x16}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5b98fcf5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x95}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5e0569f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x49}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7887546e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xb2399ad}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9c}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53696dfb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x0, 0x6, 0xb2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6bd4cf1b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7ce183d6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x98}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x3c, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x32499fef}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x16d1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1667ebc9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf322}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x352085a6d795f0e0, 0xa, 0x5cc4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x318a4b8a}]}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x800}, 0x20000004) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1020000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r0) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x35}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000811}, 0x4010) (async, rerun: 32) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x24004000) (async) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc4f}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc71}]}, 0x30}}, 0x0) (async) r3 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r3, 0x0, 0x0, 0x7, 0xc}, 0x81) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async, rerun: 64) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xec, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xf7}]}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7ebe}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x28}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2224}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0xab0b0f8a9ba8b12}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0xec}, 0x1, 0x0, 0x0, 0x4}, 0x40) (async, rerun: 32) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r2, 0x4, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xc}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xfd}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x48000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x801}, 0x804) (async, rerun: 32) syz_open_dev$usbmon(&(0x7f00000003c0), 0x10001, 0x240080) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x10000000, 0xffffffffffffffff, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x10000010000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="bf8e0b41db3f28ea6d82d77bff020acae42d7fec640c845ed3b169b7f169c722421f835b86c8741d0800"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x400000000000000, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = fsmount(r0, 0x0, 0x8c) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0xc4}, 0x4040001) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x40000100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 1: syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) r2 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000040)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x4, 0x0, 0xffffffffffffffff, &(0x7f0000000000)={0xe0002011}, r1, 0x1, 0x0, 0x1, {0x0, r2}}, 0x0) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000a, 0x5, 0x40000) r3 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r3, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x1000000000000000, 0xffffffffffffffff, 0x0) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = fsmount(r0, 0x0, 0x8c) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0xc4}, 0x4040001) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="bf8e0b41db3f28ea6d82d77bff020acae42d7fec640c845ed3b169b7f169c722421f835b86c8741d0800"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="bf8e0b41db3f28ea6d82d77bff020acae42d7fec640c845ed3b169b7f169c722421f835b86c8741d0800"], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) (async) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 20:04:06 executing program 1: syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) r2 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000040)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x4, 0x0, 0xffffffffffffffff, &(0x7f0000000000)={0xe0002011}, r1, 0x1, 0x0, 0x1, {0x0, r2}}, 0x0) (async) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000a, 0x5, 0x40000) r3 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r3, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = fsmount(r0, 0x0, 0x8c) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x2, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0xc4}, 0x4040001) (async) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x10) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="5d2bf1052a124ac625e63e6467f1ab98d7df5627daa1dad96e3af8773f3abae869d4c3a62c4da0905986354436458867d115092f8edf5446d2f098e511885900b3bc10dd81409888d915a9daa1204159d377d756c6a3ffc356c18e4f7ec82f344f35f97d70b2b2ca5b2c4dd43ff41e1a01384eb1fb013a3dd75b2f3ae95d396c4789e0446f"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x4000000) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0xffff000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 1: syz_io_uring_setup(0x1d91, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) r2 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000040)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x4, 0x0, 0xffffffffffffffff, &(0x7f0000000000)={0xe0002011}, r1, 0x1, 0x0, 0x1, {0x0, r2}}, 0x0) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000a, 0x5, 0x40000) (async) r3 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r3, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x10000000) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async, rerun: 32) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="5d2bf1052a124ac625e63e6467f1ab98d7df5627daa1dad96e3af8773f3abae869d4c3a62c4da0905986354436458867d115092f8edf5446d2f098e511885900b3bc10dd81409888d915a9daa1204159d377d756c6a3ffc356c18e4f7ec82f344f35f97d70b2b2ca5b2c4dd43ff41e1a01384eb1fb013a3dd75b2f3ae95d396c4789e0446f"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x1, 0x15, 0x401, 0x8, 0x1f, 0x0, &(0x7f0000000140)="73100233164b24dcc6c83054aae7cee545ffbf16b2b2e7654ddfe7ceeb2516"}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xccf1f430d603cf3c}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004004}, 0x0) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x400000000000000) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000140)=""/251) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}]}, 0x44}, 0x1, 0x0, 0x0, 0x40050}, 0x8000) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f0000000280)=""/24) r0 = fsmount(0xffffffffffffffff, 0x0, 0x7c) connect$tipc(r0, &(0x7f0000000240)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x2}}, 0x10) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="5d2bf1052a124ac625e63e6467f1ab98d7df5627daa1dad96e3af8773f3abae869d4c3a62c4da0905986354436458867d115092f8edf5446d2f098e511885900b3bc10dd81409888d915a9daa1204159d377d756c6a3ffc356c18e4f7ec82f344f35f97d70b2b2ca5b2c4dd43ff41e1a01384eb1fb013a3dd75b2f3ae95d396c4789e0446f"], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x1, 0x15, 0x401, 0x8, 0x1f, 0x0, &(0x7f0000000140)="73100233164b24dcc6c83054aae7cee545ffbf16b2b2e7654ddfe7ceeb2516"}) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xccf1f430d603cf3c}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004004}, 0x0) (async) write$P9_RREADDIR(r1, 0x0, 0xffcb) 20:04:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x1000000000000000) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000140)=""/251) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}]}, 0x44}, 0x1, 0x0, 0x0, 0x40050}, 0x8000) (async) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f0000000280)=""/24) (async) r0 = fsmount(0xffffffffffffffff, 0x0, 0x7c) connect$tipc(r0, &(0x7f0000000240)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x2}}, 0x10) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000040)) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="f5c1e07a2d2ebfd3d570a6aaf6453d0f5d97171104cd3a8eaab1fce9d2f27e788ae2cd21c982246c819964c392bd263564a8a395abbc410adefe68ac22c5b47b174f518b3173753d0a510c1a4a51bdba7755afa5"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, 0x0, 0x0) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000), 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000640), 0x5, 0x2281) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000700)={0x12, 0x10, 0xfa00, {0x0}}, 0x18) write$P9_RLERRORu(r1, &(0x7f0000000780)={0x25, 0x7, 0x0, {{0x18, '/dev/infiniband/rdma_cm\x00'}}}, 0x25) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) r2 = syz_open_dev$vcsn(&(0x7f0000000100), 0x3fc, 0x0) write$P9_RAUTH(r2, &(0x7f00000000c0)={0x14, 0x67, 0x1, {0x78, 0x3, 0x8}}, 0x14) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r0, 0x7ff}) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x1, 0x15, 0x401, 0x8, 0x1f, 0x0, &(0x7f0000000140)="73100233164b24dcc6c83054aae7cee545ffbf16b2b2e7654ddfe7ceeb2516"}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xccf1f430d603cf3c}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004004}, 0x0) write$P9_RREADDIR(r1, 0x0, 0xffcb) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x1, 0x15, 0x401, 0x8, 0x1f, 0x0, &(0x7f0000000140)="73100233164b24dcc6c83054aae7cee545ffbf16b2b2e7654ddfe7ceeb2516"}) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xccf1f430d603cf3c}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004004}, 0x0) (async) write$P9_RREADDIR(r1, 0x0, 0xffcb) (async) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c1991147bd38200050044737d85f05c35dc378232ee83650201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = io_uring_setup(0x7aca, &(0x7f0000000080)={0x0, 0xb68b, 0x1, 0x2, 0x326}) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x8000000) getpeername$tipc(r0, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10) 20:04:06 executing program 3: mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000140)=""/251) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}]}, 0x44}, 0x1, 0x0, 0x0, 0x40050}, 0x8000) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f0000000280)=""/24) r0 = fsmount(0xffffffffffffffff, 0x0, 0x7c) connect$tipc(r0, &(0x7f0000000240)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x2}}, 0x10) mmap$xdp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x2131, 0xffffffffffffffff, 0x0) (async) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000140)=""/251) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x22}]}, 0x44}, 0x1, 0x0, 0x0, 0x40050}, 0x8000) (async) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f0000000280)=""/24) (async) fsmount(0xffffffffffffffff, 0x0, 0x7c) (async) connect$tipc(r0, &(0x7f0000000240)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x2}}, 0x10) (async) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000040)) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="f5c1e07a2d2ebfd3d570a6aaf6453d0f5d97171104cd3a8eaab1fce9d2f27e788ae2cd21c982246c819964c392bd263564a8a395abbc410adefe68ac22c5b47b174f518b3173753d0a510c1a4a51bdba7755afa5"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000040)) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) write$P9_RREADDIR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="f5c1e07a2d2ebfd3d570a6aaf6453d0f5d97171104cd3a8eaab1fce9d2f27e788ae2cd21c982246c819964c392bd263564a8a395abbc410adefe68ac22c5b47b174f518b3173753d0a510c1a4a51bdba7755afa5"], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, 0x0, 0x0) (async) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400001, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x5, 0x4001) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfffffdef) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c1991147bd38200050044737d85f05c35dc378232ee83650201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) r1 = io_uring_setup(0x7aca, &(0x7f0000000080)={0x0, 0xb68b, 0x1, 0x2, 0x326}) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x8000000) getpeername$tipc(r0, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10) syz_open_dev$vcsn(0x0, 0x0, 0x44a440) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c1991147bd38200050044737d85f05c35dc378232ee83650201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) io_uring_setup(0x7aca, &(0x7f0000000080)={0x0, 0xb68b, 0x1, 0x2, 0x326}) (async) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, 0x0) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x8000000) (async) getpeername$tipc(r0, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10) (async) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x5, 0x4001) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004000, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000), 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000640), 0x5, 0x2281) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000700)={0x12, 0x10, 0xfa00, {0x0}}, 0x18) (async) write$P9_RLERRORu(r1, &(0x7f0000000780)={0x25, 0x7, 0x0, {{0x18, '/dev/infiniband/rdma_cm\x00'}}}, 0x25) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) r2 = syz_open_dev$vcsn(&(0x7f0000000100), 0x3fc, 0x0) write$P9_RAUTH(r2, &(0x7f00000000c0)={0x14, 0x67, 0x1, {0x78, 0x3, 0x8}}, 0x14) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r0, 0x7ff}) 20:04:06 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000040)) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="f5c1e07a2d2ebfd3d570a6aaf6453d0f5d97171104cd3a8eaab1fce9d2f27e788ae2cd21c982246c819964c392bd263564a8a395abbc410adefe68ac22c5b47b174f518b3173753d0a510c1a4a51bdba7755afa5"], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, 0x0, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff0000, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:06 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032cbd7000ffdbdf25010000000c00020006000000000000001c00078008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c1991147bd38200050044737d85f05c35dc378232ee83650201000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) r1 = io_uring_setup(0x7aca, &(0x7f0000000080)={0x0, 0xb68b, 0x1, 0x2, 0x326}) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x8000000) (async) getpeername$tipc(r0, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10) 20:04:06 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x5, 0x4001) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:06 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfffffdef) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:06 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000000)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 20:04:07 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r2 = fsmount(r0, 0x0, 0x88) write$P9_RFLUSH(r2, &(0x7f0000000040)={0x7, 0x6d, 0x1}, 0x7) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:07 executing program 2: r0 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name, &(0x7f00000000c0)=0x10, 0x800) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 2: r0 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name, &(0x7f00000000c0)=0x10, 0x800) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000), 0x4) (async, rerun: 64) r1 = syz_open_dev$vcsn(&(0x7f0000000640), 0x5, 0x2281) (rerun: 64) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000700)={0x12, 0x10, 0xfa00, {0x0}}, 0x18) (async, rerun: 64) write$P9_RLERRORu(r1, &(0x7f0000000780)={0x25, 0x7, 0x0, {{0x18, '/dev/infiniband/rdma_cm\x00'}}}, 0x25) (async, rerun: 64) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (async) r2 = syz_open_dev$vcsn(&(0x7f0000000100), 0x3fc, 0x0) write$P9_RAUTH(r2, &(0x7f00000000c0)={0x14, 0x67, 0x1, {0x78, 0x3, 0x8}}, 0x14) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r0, 0x7ff}) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 2: r0 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name, &(0x7f00000000c0)=0x10, 0x800) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000100), &(0x7f0000000140)=0x4) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name, &(0x7f00000000c0)=0x10, 0x800) (async) getsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) 20:04:07 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) write$P9_RLCREATE(r0, &(0x7f0000000000)={0x18, 0xf, 0x1, {{0x80, 0x4, 0x4}, 0x2}}, 0x18) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400001, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfffffdef) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:07 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsmount(r0, 0x1, 0x88) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f00000000c0)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "2e26f0", "843dc43c4bc7f159cc52745deeb7649f977e6735047163e1e6c8847fcf29bfbd490a896e7cb91698df70eba14a389affd0747b540a09d3ddf5ee7f09e046cd966bcf4298190a60764da6236f85b65b6ae1e0fcdec2ab5f00d602515dfa31eb549162a8c4724273ad7c200ace53d990e749d69ecba7833715b90b9c7c7cb18f269f360a5bfd79f055242e830219e9121ab4ad9064c0f7e62db66c2db5ce617e3b5e771f3c03c7c861f070a995a0169c603852799b47b84f1417326e4865340ac45007f3db225ee5d9058010a5156417915ef2595bcfff13ed3550dcd6f827077758ba78e3fa17ac7219e8341ed79b3cd3250a0d1fc1e15d85a574cb69d2f27060"}}, 0x110) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$usbmon(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000005, 0x50, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 20:04:07 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (async) write$P9_RLCREATE(r0, &(0x7f0000000000)={0x18, 0xf, 0x1, {{0x80, 0x4, 0x4}, 0x2}}, 0x18) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004000, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000000)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 20:04:07 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r2 = fsmount(r0, 0x0, 0x88) write$P9_RFLUSH(r2, &(0x7f0000000040)={0x7, 0x6d, 0x1}, 0x7) (async) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r2 = fsmount(r0, 0x0, 0x88) write$P9_RFLUSH(r2, &(0x7f0000000040)={0x7, 0x6d, 0x1}, 0x7) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) (async) syz_open_dev$vcsn(0x0, 0x1, 0x0) (async) syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) (async) fsmount(r0, 0x0, 0x88) (async) write$P9_RFLUSH(r2, &(0x7f0000000040)={0x7, 0x6d, 0x1}, 0x7) (async) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) (async) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) (async) 20:04:07 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0xff, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[], 0xffcb) (async) write$P9_RLCREATE(r0, &(0x7f0000000000)={0x18, 0xf, 0x1, {{0x80, 0x4, 0x4}, 0x2}}, 0x18) 20:04:07 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) fsmount(r0, 0x1, 0x88) (async, rerun: 64) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f00000000c0)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "2e26f0", "843dc43c4bc7f159cc52745deeb7649f977e6735047163e1e6c8847fcf29bfbd490a896e7cb91698df70eba14a389affd0747b540a09d3ddf5ee7f09e046cd966bcf4298190a60764da6236f85b65b6ae1e0fcdec2ab5f00d602515dfa31eb549162a8c4724273ad7c200ace53d990e749d69ecba7833715b90b9c7c7cb18f269f360a5bfd79f055242e830219e9121ab4ad9064c0f7e62db66c2db5ce617e3b5e771f3c03c7c861f070a995a0169c603852799b47b84f1417326e4865340ac45007f3db225ee5d9058010a5156417915ef2595bcfff13ed3550dcd6f827077758ba78e3fa17ac7219e8341ed79b3cd3250a0d1fc1e15d85a574cb69d2f27060"}}, 0x110) (rerun: 64) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async, rerun: 32) mmap$usbmon(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000005, 0x50, 0xffffffffffffffff, 0x0) (rerun: 32) socket$inet6_tcp(0xa, 0x1, 0x0) 20:04:07 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, 0x0, 0xffcb) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000800)={'gre0\x00', 0x0}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000000)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$vcsn(0x0, 0x1, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) write$P9_RREADDIR(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xfffffdef) 20:04:07 executing program 2: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) (async) fsmount(r0, 0x1, 0x88) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f00000000c0)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "2e26f0", "843dc43c4bc7f159cc52745deeb7649f977e6735047163e1e6c8847fcf29bfbd490a896e7cb91698df70eba14a389affd0747b540a09d3ddf5ee7f09e046cd966bcf4298190a60764da6236f85b65b6ae1e0fcdec2ab5f00d602515dfa31eb549162a8c4724273ad7c200ace53d990e749d69ecba7833715b90b9c7c7cb18f269f360a5bfd79f055242e830219e9121ab4ad9064c0f7e62db66c2db5ce617e3b5e771f3c03c7c861f070a995a0169c603852799b47b84f1417326e4865340ac45007f3db225ee5d9058010a5156417915ef2595bcfff13ed3550dcd6f827077758ba78e3fa17ac7219e8341ed79b3cd3250a0d1fc1e15d85a574cb69d2f27060"}}, 0x110) perf_event_open(&(0x7f0000000040)={0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) mmap$usbmon(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000005, 0x50, 0xffffffffffffffff, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) 20:04:07 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x8c6e, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000400), 0x0) syz_open_dev$usbfs(&(0x7f00000004c0), 0x0, 0x109040) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r2 = syz_open_dev$vcsn(&(0x7f0000000040), 0x3, 0x200) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080), 0x106, 0x3}}, 0x20) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0xffcb) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 20:04:07 executing program 1: r0 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r0, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$tipc(r0, &(0x7f0000000440)={&(0x7f0000000100)=@id={0x1e, 0x3, 0x2, {0x4e23}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000140)="896c302a77381842d885babceba21f8c50ed40f4c7dd84f254099eb3a38130dcd9592b20a42fc81549ced7578aed1e5c483c488f95d22334c2cf36b23d6a9550acad57d8769f7991a232fc105ae08b80da52dbd1d17a384481347a09df1c39a76f87242d2a2e5e60a159dfdcfd6c7dd00c005dc93adf90673fbb24f456cc626db9dc698a52835b479ecd82875efba20989b4c11cb0415101cc3a8f4be3cc668e32e33dd11e0c5128cae6d8e260503ce03eaf4f3b74e630ad0f8d0e6d6b90c5a94eccef4d0fd92cc1c97628", 0xcb}, {&(0x7f0000000240)="8d14aca67aa17c0a64fff2e7f8cbad0126d6ea15a3c33efdfd5061ffedab951b06553a29bc4d580dc2f3f95c18d952ddf5a26483", 0x34}, {&(0x7f0000000280)="bd954cf9873dfb796c44ad1afc2beda20f6192249b78577e8fb5528130d9afac6f26fff1e09f250f558a513e9e4b7b76f78e5aba1c82f58a436f9fd9eb02342b62865c9e96c12657666b8e07c81bfcdee15e4e37885d3c65c95852d946aaf4e54b9359a2bf14caca8fc59391e963bea3f4fb2653eba4fb24ff40f4637e6d143a57d8ee88d06da1a416674f377df6a2e34181abd309dc8380208a3e2552cddcfb304c96dc1baf4c5b9fea4e717d3a3a2f4e4cf65652e555c375c8d87d1415750fe963478764e5631752afea101c58", 0xce}], 0x3, &(0x7f00000003c0)="7d534c8fdef24a8a751a948503da469f4ec4420443dd4ea693c4a4f029f8a078df4c4650370bdde583f25eaace10ea4f10f4f2819a4c4dcd4f752de5ab78a4cb2936", 0x42, 0xc021}, 0x4044050) r1 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x100103, 0x8100) r2 = accept4$tipc(r1, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x800) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000080)=0x200, 0x4) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[], 0xffcb) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0, 0x44a440) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r1, 0x0, 0x0, 0x7, 0xc}, 0x81) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x102}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000000)) socket$inet_udplite(0x2, 0x2, 0x88) write$P9_RREADDIR(r0, 0x0, 0xffcb) 20:04:07 executing program 4: perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8030}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:04:07 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000580), 0x0, 0x121d02) r1 = syz_open_dev$vcsn(0x0, 0x0,