7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)
r3 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2)
ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000280)={0xfff, 0x1, 0x4, 0x10000, 0x0, {0x0, 0xea60}, {0x2, 0x1, 0xe9, 0x1, 0x0, 0x5, "37c15ab2"}, 0x80, 0x4, @fd, 0x9})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
r4 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2)
ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000100)={0x1, 0x1, 0x1, {0x8, @pix_mp={0x5, 0x6, 0x56544943, 0x8, 0x7, [{0x1, 0x3}, {0x0, 0x8000}, {0xffff, 0x1ff}, {0x0, 0x7}, {0x5, 0x6}, {0x5, 0x4}, {0x20, 0x3}, {0x57f6, 0x80000000}], 0x3, 0x2, 0x2, 0x2, 0x1}}, 0x1ff})

04:37:53 executing program 4:
shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:53 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:53 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:53 executing program 2:
madvise(&(0x7f0000ff6000/0x2000)=nil, 0x2000, 0x1)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)

04:37:53 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0)

04:37:53 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)
r3 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2)
ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000280)={0xfff, 0x1, 0x4, 0x10000, 0x0, {0x0, 0xea60}, {0x2, 0x1, 0xe9, 0x1, 0x0, 0x5, "37c15ab2"}, 0x80, 0x4, @fd, 0x9})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2)

04:37:53 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:53 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:53 executing program 2:
madvise(&(0x7f0000ff6000/0x2000)=nil, 0x2000, 0x1)

04:37:53 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:53 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), 0x0, 0x0)

04:37:53 executing program 2:
madvise(&(0x7f0000ff6000/0x2000)=nil, 0x2000, 0x0)

04:37:53 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:53 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)
r3 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2)
ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000280)={0xfff, 0x1, 0x4, 0x10000, 0x0, {0x0, 0xea60}, {0x2, 0x1, 0xe9, 0x1, 0x0, 0x5, "37c15ab2"}, 0x80, 0x4, @fd, 0x9})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)

04:37:53 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)
madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc)

04:37:53 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:53 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)
madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc)

04:37:53 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)
madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc)

04:37:53 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), 0x0, 0x0)

04:37:53 executing program 2:
madvise(&(0x7f0000ff6000/0x2000)=nil, 0x2000, 0x0)

04:37:54 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)
r3 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2)
ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000280)={0xfff, 0x1, 0x4, 0x10000, 0x0, {0x0, 0xea60}, {0x2, 0x1, 0xe9, 0x1, 0x0, 0x5, "37c15ab2"}, 0x80, 0x4, @fd, 0x9})

04:37:54 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)
madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc)

04:37:54 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)
madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc)

04:37:54 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), 0x0, 0x0)

04:37:54 executing program 2:
madvise(&(0x7f0000ff6000/0x2000)=nil, 0x2000, 0x0)

04:37:54 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)
madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc)

04:37:54 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)
syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2)

04:37:54 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0)

04:37:54 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)
r3 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2)
ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000280)={0xfff, 0x1, 0x4, 0x10000, 0x0, {0x0, 0xea60}, {0x2, 0x1, 0xe9, 0x1, 0x0, 0x5, "37c15ab2"}, 0x80, 0x4, @fd, 0x9})

04:37:54 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0)

04:37:54 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r2, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20044004)

04:37:54 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:54 executing program 0:
shmget(0x0, 0x5000, 0x10, &(0x7f0000ffb000/0x5000)=nil)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:54 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')

04:37:54 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:54 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], 0x0)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:54 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:37:54 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)

04:37:54 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 3:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0, 0x0], 0x0)

04:37:54 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:54 executing program 3:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:54 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0], 0x0)

04:37:54 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:37:54 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:54 executing program 3:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:54 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:54 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080)=[0x0], 0x0)

04:37:54 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:54 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:54 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:55 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:55 executing program 1:
move_pages(0x0, 0x2, &(0x7f0000000000)=[&(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x2000)=nil], &(0x7f0000000040), &(0x7f0000000080), 0x0)

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:55 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)

04:37:55 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:55 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:55 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:55 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)

04:37:55 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:55 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:37:55 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:55 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:55 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0)

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:55 executing program 5:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:55 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:37:55 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:55 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0)

04:37:55 executing program 5:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x40})

04:37:55 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0)

04:37:55 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})

04:37:55 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:55 executing program 5:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:55 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6)

04:37:55 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:55 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)

04:37:55 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 5:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:55 executing program 3:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000200)={0x0, {0x8, 0x4}})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_genetlink_get_family_id$gtp(&(0x7f0000000340)='gtp\x00')

04:37:55 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)

04:37:55 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:55 executing program 5:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:55 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)
ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000180)={0x9, 0xc000c, "55dd35a1c03102f9959f3b69c957666b60cfcf7b99a1ff1c", {0xfe6b}, 0x4f42})
r6 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x1815, 0x109200)
r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_GET(r6, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x58, r7, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008000}, 0x20004000)

04:37:56 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:56 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:37:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:56 executing program 5:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)
ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000180)={0x9, 0xc000c, "55dd35a1c03102f9959f3b69c957666b60cfcf7b99a1ff1c", {0xfe6b}, 0x4f42})
r6 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x1815, 0x109200)
r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_GET(r6, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x58, r7, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008000}, 0x20004000)

04:37:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:56 executing program 1:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 2:
shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:56 executing program 5:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)
ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000180)={0x9, 0xc000c, "55dd35a1c03102f9959f3b69c957666b60cfcf7b99a1ff1c", {0xfe6b}, 0x4f42})
r6 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x1815, 0x109200)
r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_GET(r6, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x58, r7, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008000}, 0x20004000)

04:37:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:56 executing program 1:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:37:56 executing program 5:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:56 executing program 1:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:56 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)
ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000180)={0x9, 0xc000c, "55dd35a1c03102f9959f3b69c957666b60cfcf7b99a1ff1c", {0xfe6b}, 0x4f42})
syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x1815, 0x109200)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000240)='l2tp\x00')

04:37:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:57 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)
ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000180)={0x9, 0xc000c, "55dd35a1c03102f9959f3b69c957666b60cfcf7b99a1ff1c", {0xfe6b}, 0x4f42})
syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x1815, 0x109200)

04:37:57 executing program 5:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:57 executing program 1:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:57 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:57 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:37:57 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)
ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000180)={0x9, 0xc000c, "55dd35a1c03102f9959f3b69c957666b60cfcf7b99a1ff1c", {0xfe6b}, 0x4f42})

04:37:57 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:37:57 executing program 1:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:57 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:57 executing program 1:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:57 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:57 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:37:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:57 executing program 1:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:58 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:37:58 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)=0x8)

04:37:58 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:37:58 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:37:58 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:58 executing program 1:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:58 executing program 1:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:58 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:58 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r5 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0xa0402012}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00fdff", @ANYRESDEC, @ANYBLOB="10002a89f5f5687c9bb2df29872ba603ed920dd18893340000000000000006000e0d395c3f6407a229ba57a3a634a364dda45527fc5f9602fb914b4f81f4346c83fa523cc8150cd0546e45f0d012cf7a3e110000000000000001fdf98a7cfc1719ccaa7eceb92553efdfc560b6608c91e7cffd6b72d61ccb7c45d41b49e2354611c3fa3acfd8ae430d"], 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0)

04:37:58 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x0)

04:37:58 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:58 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:37:59 executing program 3:
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:37:59 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x4, 0x10000)

04:37:59 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:37:59 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:59 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:59 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x0)

04:37:59 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:59 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:37:59 executing program 0:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r3=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r3, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))

04:37:59 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:59 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x0)

04:37:59 executing program 3:
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:37:59 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:59 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:59 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r2=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r2, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:37:59 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:59 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:37:59 executing program 3:
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:37:59 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r2=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r2, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:37:59 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:37:59 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 3:
socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:00 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r2=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r2, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:00 executing program 3:
socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r2=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r2, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:00 executing program 3:
socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r2=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r2, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, 0x0, 0x40010020)

04:38:00 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2, <r2=>0x0}, &(0x7f0000000500)=0xc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', r2, 0x2f, 0x1, 0x80, 0x9, 0x45, @ipv4={[], [], @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0xc, 0x3f}})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, 0x0, 0x40010020)

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, 0x0, 0x40010020)

04:38:00 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 0:
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000004c0)={@local, @multicast2}, &(0x7f0000000500)=0xc)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000})

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:00 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 0:
userfaultfd(0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616"})

04:38:00 executing program 2:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 4:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 0:
userfaultfd(0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:00 executing program 4:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:00 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0xffff8000})

04:38:01 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:01 executing program 2:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:01 executing program 0:
userfaultfd(0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:01 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:38:01 executing program 4:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:01 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000})

04:38:01 executing program 4:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:01 executing program 2:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:01 executing program 4:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:01 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616"})

04:38:01 executing program 5:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x4, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:01 executing program 0:
userfaultfd(0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:02 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:02 executing program 2:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:02 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:38:02 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x7000)

04:38:02 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:02 executing program 5:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000080)={0x0, {0x7ff, 0x4}})
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000))
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f00000000c0)={0x10001, 0x7, 0x4, 0x0, 0xff, {0x0, 0xea60}, {0x5, 0xc, 0x8, 0x6, 0x3, 0x7, "4c6826d6"}, 0x5, 0x1, @offset=0x5ca, 0x81})
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}})

04:38:02 executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:02 executing program 2:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:02 executing program 1:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:02 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:38:02 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)

04:38:02 executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:03 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, 0x40010020)

04:38:03 executing program 2:
r0 = syz_open_dev$swradio(0x0, 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:03 executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:03 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)

04:38:03 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:38:03 executing program 1:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
shmget(0x0, 0x2000, 0x1, &(0x7f0000ffc000/0x2000)=nil)
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)

04:38:03 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)

04:38:03 executing program 2:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:03 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:03 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x50, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:03 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:03 executing program 2:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:04 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x40010020)

04:38:04 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x11)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ff6000/0x2000)=nil, 0x2000})

04:38:04 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x7fffffff, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:04 executing program 2:
syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:04 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
userfaultfd(0x80800)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:04 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:04 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x11)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ff6000/0x2000)=nil, 0x2000})

04:38:04 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:04 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:38:04 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x11)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ff6000/0x2000)=nil, 0x2000})

04:38:04 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x4, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:04 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000000)={@dev}, &(0x7f0000000080)=0xc)

04:38:05 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg$can_bcm(r0, &(0x7f0000001180)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0)

04:38:05 executing program 5:
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:05 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:38:05 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x11)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmallocinfo\x00', 0x0, 0x0)

04:38:05 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:05 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:05 executing program 5:
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:05 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3ff, 0xffff8000})

04:38:05 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:05 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, 0x0)

04:38:05 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x11)

04:38:05 executing program 5:
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:06 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x0)

04:38:06 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:06 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0xffff8000})

04:38:06 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:06 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x0)

04:38:06 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:06 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000})

04:38:06 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x0)

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:06 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616"})

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x0, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3ff, 0xffff8000})

04:38:06 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x0)

04:38:06 executing program 1:
madvise(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0x0)

04:38:06 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f00000000c0)=0x10)

04:38:06 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x6)

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3ff, 0xffff8000})

04:38:06 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x0)

04:38:06 executing program 3:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x3})
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:06 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0)

04:38:06 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f00000000c0)=0x10)

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0xffff8000})

04:38:06 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x12)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000000)="0fc75afcd6d7baf80c66b8b4300e8d66efbafc0c66ed660ffc01f30fb7492ba5baf80c66b83455768f66efbafc0c66ed885a0f66b93a0a000066b85fbd000066ba000000000f30", 0x47}], 0x1, 0x5f, &(0x7f00000000c0)=[@cr0={0x0, 0x80000000}, @vmwrite={0x8, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7e}], 0x2)

04:38:06 executing program 3:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0)

04:38:06 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x3})
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000})

04:38:06 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f00000000c0)=0x10)

04:38:06 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x12)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000000)="0fc75afcd6d7baf80c66b8b4300e8d66efbafc0c66ed660ffc01f30fb7492ba5baf80c66b83455768f66efbafc0c66ed885a0f66b93a0a000066b85fbd000066ba000000000f30", 0x47}], 0x1, 0x5f, &(0x7f00000000c0)=[@cr0={0x0, 0x80000000}, @vmwrite={0x8, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7e}], 0x2)

04:38:06 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x3})
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:06 executing program 3:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 5:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0)

04:38:06 executing program 2:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000040)={0x81, "b8bd9471bb0e4570b4d858605443e0bbdda6c9b2d90d2d6d5415af15b36e0616"})

04:38:06 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x12)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000000)="0fc75afcd6d7baf80c66b8b4300e8d66efbafc0c66ed660ffc01f30fb7492ba5baf80c66b83455768f66efbafc0c66ed885a0f66b93a0a000066b85fbd000066ba000000000f30", 0x47}], 0x1, 0x5f, &(0x7f00000000c0)=[@cr0={0x0, 0x80000000}, @vmwrite={0x8, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7e}], 0x2)

04:38:06 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0)
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x4000})
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:06 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:06 executing program 5:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/handlers\x00', 0x0, 0x0)
inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x20000200)
shmget(0x3, 0x3000, 0x1206dc46c5cac4e6, &(0x7f0000ff8000/0x3000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffc000/0x3000)=nil, 0xc000)
r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x80, 0x2c4000)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x2000)=nil, 0x2000}, 0x1})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
munmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000)

04:38:06 executing program 3:
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:06 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x12)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)

04:38:06 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:06 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:38:06 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:06 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:06 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:38:07 executing program 3:
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:07 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x12)

04:38:07 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:07 executing program 3:
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000080))

04:38:07 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x0)

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:07 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, &(0x7f0000000080))

04:38:07 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:07 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 1:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x0)

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 1:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 2:
clock_adjtime(0x0, 0x0)

04:38:07 executing program 4:
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, &(0x7f0000000080))

04:38:07 executing program 1:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 2:
clock_adjtime(0x0, 0x0)

04:38:07 executing program 0:
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x0)

04:38:07 executing program 4:
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 1:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 2:
clock_adjtime(0x0, 0x0)

04:38:07 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, &(0x7f0000000080))

04:38:07 executing program 4:
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:07 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x0, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:07 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:38:07 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x0, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:07 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:38:07 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x0, 0x5, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6)

04:38:07 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:07 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:07 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x8000, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:07 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:38:07 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0)

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 3:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)
r0 = fork()
syz_open_procfs$namespace(r0, 0x0)
move_pages(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000ffd000/0x3000)=nil], &(0x7f00000000c0)=[0x7f5, 0x40, 0x1, 0x62, 0x8, 0xff, 0xa59, 0xffff, 0x8, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x4041)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1})
r2 = fork()
sched_getparam(r2, &(0x7f0000000140))
move_pages(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000ffc000/0x4000)=nil], &(0x7f00000001c0)=[0x6, 0x1, 0x101, 0xb3e, 0x8000, 0x4], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x2)

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x401, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0)

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0xe1, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0)

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 3:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)
r0 = fork()
syz_open_procfs$namespace(r0, 0x0)
move_pages(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000ffd000/0x3000)=nil], &(0x7f00000000c0)=[0x7f5, 0x40, 0x1, 0x62, 0x8, 0xff, 0xa59, 0xffff, 0x8, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x4041)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1})
r2 = fork()
sched_getparam(r2, &(0x7f0000000140))
move_pages(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000ffc000/0x4000)=nil], &(0x7f00000001c0)=[0x6, 0x1, 0x101, 0xb3e, 0x8000, 0x4], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x2)

04:38:08 executing program 0:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 0:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 4:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)
r0 = fork()
syz_open_procfs$namespace(r0, 0x0)
move_pages(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000ffd000/0x3000)=nil], &(0x7f00000000c0)=[0x7f5, 0x40, 0x1, 0x62, 0x8, 0xff, 0xa59, 0xffff, 0x8, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x4041)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1})
r2 = fork()
sched_getparam(r2, &(0x7f0000000140))
move_pages(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000ffc000/0x4000)=nil], &(0x7f00000001c0)=[0x6, 0x1, 0x101, 0xb3e, 0x8000, 0x4], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x2)

04:38:08 executing program 0:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 3:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)
r0 = fork()
syz_open_procfs$namespace(r0, 0x0)
move_pages(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000ffd000/0x3000)=nil], &(0x7f00000000c0)=[0x7f5, 0x40, 0x1, 0x62, 0x8, 0xff, 0xa59, 0xffff, 0x8, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x4041)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1})
r2 = fork()
sched_getparam(r2, &(0x7f0000000140))
move_pages(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000ffc000/0x4000)=nil], &(0x7f00000001c0)=[0x6, 0x1, 0x101, 0xb3e, 0x8000, 0x4], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x2)

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 0:
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 0:
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1})

04:38:08 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 5:
shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:08 executing program 0:
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x22})

04:38:08 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:08 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, 0x0)

04:38:08 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)

04:38:08 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 3:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8000000005, 0x10480)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}})
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/bus/input/devices\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x4, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8803}, 0x4040000)

04:38:09 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xad, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, 0x0)

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, 0x0)

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31b4, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))

04:38:09 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}})

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))

04:38:09 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x4, 0x5, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x40804}, 0x200000c0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
ioctl$VIDIOC_TRY_ENCODER_CMD(r2, 0xc028564e, &(0x7f00000000c0)={0x1, 0x1, [0x3fea, 0x7, 0x7, 0x1, 0x18000000, 0x9, 0x100, 0x10001]})
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))

04:38:09 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x4, 0x5, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x40804}, 0x200000c0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
ioctl$VIDIOC_TRY_ENCODER_CMD(r2, 0xc028564e, &(0x7f00000000c0)={0x1, 0x1, [0x3fea, 0x7, 0x7, 0x1, 0x18000000, 0x9, 0x100, 0x10001]})
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x4, 0x5, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x40804}, 0x200000c0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
ioctl$VIDIOC_TRY_ENCODER_CMD(r2, 0xc028564e, &(0x7f00000000c0)={0x1, 0x1, [0x3fea, 0x7, 0x7, 0x1, 0x18000000, 0x9, 0x100, 0x10001]})
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x40000, 0x0)

04:38:09 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x4, 0x5, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x40804}, 0x200000c0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
ioctl$VIDIOC_TRY_ENCODER_CMD(r2, 0xc028564e, &(0x7f00000000c0)={0x1, 0x1, [0x3fea, 0x7, 0x7, 0x1, 0x18000000, 0x9, 0x100, 0x10001]})
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:09 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
shmget(0x3, 0xa000, 0x0, &(0x7f0000ff3000/0xa000)=nil)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:09 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:09 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x4, 0x5, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x40804}, 0x200000c0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:09 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x105, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:09 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
shmget(0x3, 0xa000, 0x0, &(0x7f0000ff3000/0xa000)=nil)

04:38:09 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:09 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x4, 0x5, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x40804}, 0x200000c0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:10 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)
shmget(0x3, 0xa000, 0x0, &(0x7f0000ff3000/0xa000)=nil)

04:38:10 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})
msync(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0)

04:38:10 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0xfffffffffffffffc})

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc})

04:38:10 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 3:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:10 executing program 2:
clock_adjtime(0x0, &(0x7f0000000000)={0x4ad65a54})

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x100000005, 0x6000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 3:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000fee000/0x2000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mmap$usbmon(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x1000008, 0x30, 0xffffffffffffffff, 0x6)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 3:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000fee000/0x2000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x2000)=nil, 0x2000)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:10 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000fee000/0x2000)=nil, 0xc000)
madvise(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0xc)

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:10 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:10 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:10 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000fee000/0x2000)=nil, 0xc000)

04:38:10 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:10 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:10 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:11 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 1:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 1:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 1:
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 5:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 5:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xcd4, "34f2b45733d3e35e1c1abb7f739759f693bf1464b19abdc9e546fbca7e12f898"})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:11 executing program 0:
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000000)={0x0, {0x7f, 0x7}})
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:11 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:11 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:11 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:11 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 5:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x8, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x0)
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})

04:38:12 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {0x10000, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:12 executing program 0:
r0 = syz_open_dev$swradio(0x0, 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:12 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:12 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {0x0, 0x6, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0)

04:38:12 executing program 0:
r0 = syz_open_dev$swradio(0x0, 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:12 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:12 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {0x0, 0x0, 0x4, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:12 executing program 5 (fault-call:4 fault-nth:0):
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0)

04:38:12 executing program 0:
r0 = syz_open_dev$swradio(0x0, 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:12 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:12 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {0x0, 0x0, 0x0, 0x8}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

[  782.883746] FAULT_INJECTION: forcing a failure.
[  782.883746] name failslab, interval 1, probability 0, space 0, times 0
04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0)

[  782.949708] CPU: 0 PID: 28092 Comm: syz-executor.5 Not tainted 4.14.218-syzkaller #0
[  782.957629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  782.966989] Call Trace:
[  782.969581]  dump_stack+0x1b2/0x281
[  782.973214]  should_fail.cold+0x10a/0x149
[  782.977369]  should_failslab+0xd6/0x130
[  782.981375]  kmem_cache_alloc_trace+0x29a/0x3d0
[  782.986043]  do_shmat+0x500/0xdc0
[  782.989500]  ? compat_SyS_shmctl+0x4c0/0x4c0
[  782.993916]  SyS_shmat+0x6c/0xb0
04:38:12 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

[  782.997284]  ? do_shmat+0xdc0/0xdc0
[  783.000911]  ? do_syscall_64+0x4c/0x640
[  783.004882]  ? do_shmat+0xdc0/0xdc0
[  783.008507]  do_syscall_64+0x1d5/0x640
[  783.012403]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[  783.017589] RIP: 0033:0x465b09
[  783.020801] RSP: 002b:00007f6ee96b4188 EFLAGS: 00000246 ORIG_RAX: 000000000000001e
[  783.028506] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
[  783.035774] RDX: 000000000000d000 RSI: 0000000020ffc000 RDI: 0000000000a7814f
[  783.043045] RBP: 00007f6ee96b41d0 R08: 0000000000000000 R09: 0000000000000000
04:38:12 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0)

04:38:12 executing program 0:
syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

[  783.050313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  783.057606] R13: 00007ffce06e1b7f R14: 00007f6ee96b4300 R15: 0000000000022000
04:38:12 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 5 (fault-call:4 fault-nth:1):
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {}, {0xf1cf, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:12 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
shmat(r0, &(0x7f0000ff4000/0x1000)=nil, 0x5000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:12 executing program 2:
shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff4000/0x3000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 0:
syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:12 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:12 executing program 3:
syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:12 executing program 0:
syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:12 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:12 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {}, {0x0, 0x1, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

[  783.320141] FAULT_INJECTION: forcing a failure.
[  783.320141] name failslab, interval 1, probability 0, space 0, times 0
[  783.379791] CPU: 1 PID: 28133 Comm: syz-executor.5 Not tainted 4.14.218-syzkaller #0
[  783.387707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  783.397061] Call Trace:
[  783.399652]  dump_stack+0x1b2/0x281
[  783.403299]  should_fail.cold+0x10a/0x149
[  783.407459]  should_failslab+0xd6/0x130
[  783.411438]  kmem_cache_alloc+0x28e/0x3c0
[  783.415598]  get_empty_filp+0x86/0x3e0
[  783.419489]  alloc_file+0x23/0x440
[  783.423076]  do_shmat+0x596/0xdc0
[  783.426539]  ? compat_SyS_shmctl+0x4c0/0x4c0
[  783.430958]  SyS_shmat+0x6c/0xb0
[  783.434328]  ? do_shmat+0xdc0/0xdc0
[  783.437964]  ? do_syscall_64+0x4c/0x640
[  783.441938]  ? do_shmat+0xdc0/0xdc0
[  783.445574]  do_syscall_64+0x1d5/0x640
[  783.449474]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[  783.454665] RIP: 0033:0x465b09
[  783.457861] RSP: 002b:00007f6ee96b4188 EFLAGS: 00000246 ORIG_RAX: 000000000000001e
[  783.465597] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
[  783.472868] RDX: 000000000000d000 RSI: 0000000020ffc000 RDI: 0000000000a88151
04:38:12 executing program 3 (fault-call:2 fault-nth:0):
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

[  783.480135] RBP: 00007f6ee96b41d0 R08: 0000000000000000 R09: 0000000000000000
[  783.487406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  783.494677] R13: 00007ffce06e1b7f R14: 00007f6ee96b4300 R15: 0000000000022000
04:38:13 executing program 5 (fault-call:4 fault-nth:2):
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, 0x0)

04:38:13 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:13 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:13 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {}, {0x0, 0x0, 0x5, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, 0x0)

04:38:13 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:13 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x8})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

[  783.624310] FAULT_INJECTION: forcing a failure.
[  783.624310] name failslab, interval 1, probability 0, space 0, times 0
04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, 0x0)

[  783.716401] CPU: 0 PID: 28161 Comm: syz-executor.5 Not tainted 4.14.218-syzkaller #0
[  783.724308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  783.733683] Call Trace:
[  783.736277]  dump_stack+0x1b2/0x281
[  783.739908]  should_fail.cold+0x10a/0x149
[  783.744060]  should_failslab+0xd6/0x130
[  783.748039]  kmem_cache_alloc_trace+0x29a/0x3d0
[  783.752711]  apparmor_file_alloc_security+0x129/0x800
[  783.757909]  security_file_alloc+0x66/0xa0
[  783.762163]  ? selinux_is_enabled+0x5/0x50
[  783.766399]  get_empty_filp+0x15c/0x3e0
[  783.770538]  alloc_file+0x23/0x440
[  783.774086]  do_shmat+0x596/0xdc0
[  783.777568]  ? compat_SyS_shmctl+0x4c0/0x4c0
[  783.781988]  SyS_shmat+0x6c/0xb0
[  783.785364]  ? do_shmat+0xdc0/0xdc0
[  783.788994]  ? do_syscall_64+0x4c/0x640
[  783.792995]  ? do_shmat+0xdc0/0xdc0
[  783.796630]  do_syscall_64+0x1d5/0x640
[  783.800529]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[  783.805717] RIP: 0033:0x465b09
[  783.808925] RSP: 002b:00007f6ee96b4188 EFLAGS: 00000246 ORIG_RAX: 000000000000001e
04:38:13 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

[  783.816639] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
[  783.823909] RDX: 000000000000d000 RSI: 0000000020ffc000 RDI: 0000000000a98153
[  783.831178] RBP: 00007f6ee96b41d0 R08: 0000000000000000 R09: 0000000000000000
[  783.838450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  783.845722] R13: 00007ffce06e1b7f R14: 00007f6ee96b4300 R15: 0000000000022000
04:38:13 executing program 5 (fault-call:4 fault-nth:3):
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {}, {0x0, 0x0, 0x0, 0x2}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:13 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vim2m\x00', 0x2, 0x0)
ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f00000000c0)={0x990000, 0x0, 0x4, r1, 0x0, &(0x7f0000000080)={0x990af7, 0xd9b, [], @value=0x9}})

04:38:13 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:13 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:13 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:13 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x1})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:13 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

[  784.012202] FAULT_INJECTION: forcing a failure.
[  784.012202] name failslab, interval 1, probability 0, space 0, times 0
[  784.061071] CPU: 1 PID: 28199 Comm: syz-executor.5 Not tainted 4.14.218-syzkaller #0
[  784.069355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  784.078727] Call Trace:
[  784.081322]  dump_stack+0x1b2/0x281
[  784.084962]  should_fail.cold+0x10a/0x149
[  784.089118]  should_failslab+0xd6/0x130
[  784.093119]  kmem_cache_alloc+0x28e/0x3c0
[  784.097269]  ? shm_fault+0xf0/0xf0
[  784.100810]  __split_vma+0xc8/0x6c0
[  784.104449]  do_munmap+0xa00/0xc30
[  784.107997]  mmap_region+0x217/0x1220
[  784.111807]  do_mmap+0x5b3/0xcb0
[  784.115184]  do_shmat+0xba1/0xdc0
[  784.118647]  ? compat_SyS_shmctl+0x4c0/0x4c0
[  784.123064]  SyS_shmat+0x6c/0xb0
[  784.126428]  ? do_shmat+0xdc0/0xdc0
[  784.130057]  ? do_syscall_64+0x4c/0x640
[  784.134032]  ? do_shmat+0xdc0/0xdc0
[  784.137662]  do_syscall_64+0x1d5/0x640
[  784.141560]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[  784.146747] RIP: 0033:0x465b09
[  784.149960] RSP: 002b:00007f6ee96b4188 EFLAGS: 00000246 ORIG_RAX: 000000000000001e
04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:13 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {}, {}, {0xfffffffc, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

[  784.157669] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
[  784.164940] RDX: 000000000000d000 RSI: 0000000020ffc000 RDI: 0000000000aa8155
[  784.172296] RBP: 00007f6ee96b41d0 R08: 0000000000000000 R09: 0000000000000000
[  784.179582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  784.186857] R13: 00007ffce06e1b7f R14: 00007f6ee96b4300 R15: 0000000000022000
04:38:13 executing program 5 (fault-call:4 fault-nth:4):
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:13 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}, 0x2})

04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x100, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:13 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000)={0x0, {}, {}, {0x0, 0x63e5ee8a}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:13 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

[  784.402615] FAULT_INJECTION: forcing a failure.
[  784.402615] name failslab, interval 1, probability 0, space 0, times 0
[  784.428011] CPU: 1 PID: 28236 Comm: syz-executor.5 Not tainted 4.14.218-syzkaller #0
[  784.435920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  784.445363] Call Trace:
[  784.447958]  dump_stack+0x1b2/0x281
04:38:13 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0xc8, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:13 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:13 executing program 3:
r0 = userfaultfd(0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/key-users\x00', 0x0, 0x0)
ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x10})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ff7000/0x4000)=nil, 0x4000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ff9000/0x2000)=nil, 0x2000}, 0x3})

[  784.451606]  should_fail.cold+0x10a/0x149
[  784.455783]  should_failslab+0xd6/0x130
[  784.459787]  kmem_cache_alloc+0x28e/0x3c0
[  784.463945]  mmap_region+0x7c1/0x1220
[  784.467851]  do_mmap+0x5b3/0xcb0
[  784.471229]  do_shmat+0xba1/0xdc0
[  784.474686]  ? compat_SyS_shmctl+0x4c0/0x4c0
[  784.479107]  SyS_shmat+0x6c/0xb0
[  784.482480]  ? do_shmat+0xdc0/0xdc0
[  784.486110]  ? do_syscall_64+0x4c/0x640
[  784.490085]  ? do_shmat+0xdc0/0xdc0
[  784.493717]  do_syscall_64+0x1d5/0x640
[  784.497613]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
04:38:13 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

[  784.502801] RIP: 0033:0x465b09
[  784.505987] RSP: 002b:00007f6ee96b4188 EFLAGS: 00000246 ORIG_RAX: 000000000000001e
[  784.513694] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
[  784.520960] RDX: 000000000000d000 RSI: 0000000020ffc000 RDI: 0000000000ab8157
[  784.528227] RBP: 00007f6ee96b41d0 R08: 0000000000000000 R09: 0000000000000000
[  784.535504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  784.535511] R13: 00007ffce06e1b7f R14: 00007f6ee96b4300 R15: 0000000000022000
04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 5 (fault-call:4 fault-nth:5):
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x1, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:14 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x2, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:14 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
socketpair(0x2c, 0x800, 0x20, &(0x7f00000002c0)={<r1=>0xffffffffffffffff})
sendto$l2tp(r1, &(0x7f00000000c0)="3a8103000000000000007e16c1ca3b0487b0baf9cd404cb3c06cd3b1fbff125e1abcb2fc6de3dcefce8fa9304dfb1182db190000daa0", 0x36, 0x1, &(0x7f0000000380)={0x2, 0x0, @local, 0x1}, 0x10)
syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x2, 0x2)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:14 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 3:
r0 = userfaultfd(0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/tty/ldiscs\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x60})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x80, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x0)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0xc)

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x8, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:14 executing program 3:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x0)

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffb000/0x3000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x2000, 0x400, &(0x7f0000ffd000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x3000)=nil, 0x0)

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb4, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:14 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x40})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffb000/0x2000)=nil, 0x2000})

04:38:14 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x0)

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 3:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "f77e3903"}, 0x40007, 0x1, @fd, 0x7b})

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3ff, 0x0)
mmap$usbmon(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000, 0x4010, r1, 0x7ff)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 1:
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000000))
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
madvise(&(0x7f0000ff0000/0x2000)=nil, 0x2000, 0x0)

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "f77e3903"}, 0x0, 0x1, @fd, 0x7b})

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:14 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:14 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xff, 0x26200)
ioctl$VIDIOC_G_JPEGCOMP(r0, 0x808c563d, &(0x7f00000000c0))
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:14 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "f77e3903"}, 0x0, 0x0, @fd, 0x7b})

04:38:14 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:15 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000000)="67f00fb14dcf660f3831e0650fc7b3060078000fae6cef2e640f009506ac0fc7bc69000f01cbf607a90f20d86635200000000f22d8", 0x35}], 0x1, 0x16, &(0x7f0000000080), 0x0)
shmat(r1, &(0x7f0000ffc000/0x2000)=nil, 0x8000)

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xfffffffffffffffa, 0x501)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x6c, 0x0, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'ip6gre0\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x5}, 0x20048811)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
inotify_rm_watch(0xffffffffffffffff, 0x0)

04:38:15 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 0:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "f77e3903"}, 0x0, 0x0, @fd})

04:38:15 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:15 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r3 = accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00')
sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x0, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@GTPA_TID={0xc}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010101}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r4}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}, @GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0xaccf5f3a470d8fb5)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f00000002c0)=0x10)

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x2)
clock_gettime(0x0, &(0x7f00000000c0))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x3, 0x101})
ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000100)={0x7, 0x4, 0x4, 0x1000, 0x1, {}, {0x4, 0x1, 0x7, 0x7f, 0xf0, 0x5, "175ad533"}, 0x10, 0x4, @offset=0x8, 0x10000})

04:38:15 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:15 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0xa20000, 0x6597, 0x3f, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x9d0001, 0x43, [], @p_u8=&(0x7f0000000080)=0x1}})

04:38:15 executing program 4:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:15 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r3 = accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00')
sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x0, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@GTPA_TID={0xc}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010101}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r4}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}, @GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0xaccf5f3a470d8fb5)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f00000002c0)=0x10)

04:38:15 executing program 5:
socket$inet6_udp(0xa, 0x2, 0x0)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = shmget$private(0x0, 0x1000, 0x200, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ff0000/0x10000)=nil, 0x2000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x2f, 0x8, 0x3, 0x9, 0x20, @empty, @mcast2, 0xc7, 0x80, 0x7f, 0x7}})
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
socket$inet6_udp(0xa, 0x2, 0x0)

04:38:15 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r3 = accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00')
sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x0, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@GTPA_TID={0xc}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010101}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r4}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}, @GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0xaccf5f3a470d8fb5)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f00000002c0)=0x10)

04:38:15 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:15 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r3 = accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00')
sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x0, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@GTPA_TID={0xc}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010101}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r4}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}, @GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0xaccf5f3a470d8fb5)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f00000002c0)=0x10)

04:38:15 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
fork()
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0xc000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
socketpair(0x23, 0x800, 0x8, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x4}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x40005}, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x20})

04:38:15 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:15 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})

04:38:15 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r3 = accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00')
sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x0, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@GTPA_TID={0xc}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010101}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r4}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}, @GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0xaccf5f3a470d8fb5)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 5:
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x3000, 0x100, &(0x7f0000ffc000/0x3000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x7000)
r2 = shmget$private(0x0, 0x4000, 0x320, &(0x7f0000ff8000/0x4000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r3 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r3, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x1000)=nil, 0x1000)

04:38:15 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:15 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffc000/0x2000)=nil, 0x2000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:15 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00')
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:15 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:15 executing program 1:
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x3000, 0x100, &(0x7f0000ffc000/0x3000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x7000)
r2 = shmget$private(0x0, 0x4000, 0x320, &(0x7f0000ff8000/0x4000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r3 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r3, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x1000)=nil, 0x1000)

04:38:15 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x3})

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
accept4(r1, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="b9800000c00f3235000800000f3066baa00066b8a10066ef0f20d835080000000f22d8f30fc736b805000000b9080000000f01c1450f01df660f2317650f015c60db660f38821df2bd000040d37b9a", 0x4f}], 0x1, 0x40, &(0x7f00000000c0)=[@vmwrite={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x80000000}, @dstype3={0x7, 0x8}], 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xe800)
msync(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1)

04:38:16 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
socket$l2tp(0x2, 0x2, 0x73)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:16 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_DBG_G_REGISTER(r1, 0xc0385650, &(0x7f0000000080)={{0x0, @addr=0xffffffff}, 0x8, 0x3, 0x10})

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, 0x3000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000000c0)={'ip6gre0\x00', 0x0, 0x29, 0x81, 0x6, 0xfffffffe, 0x1a, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @local, 0x8, 0x1, 0x0, 0x1}})

04:38:16 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = userfaultfd(0x80000)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 3:
r0 = syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x1, 0x2)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f00000000c0)={0x0, {0xc0, 0x9}})
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ff1000/0xf000)=nil, 0xf000})
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget(0x3, 0x4000, 0x78000000, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffb000/0x3000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000000)="208fbe85e19c2588f394a08f665611fb7ae0041a6b6b10d51a845ec9cf842087e441edb7353dce6f03854be79c875a5b2124087f9733308d6d3534b812761d15edded36e4c14bdbe2604bfa44dc529dba3812ee0505e2d6ada6a24fdc5d44201", 0x60}, 0x68)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)
r3 = socket$inet6(0xa, 0x5, 0x1)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@private0}, 0x0, @in=@multicast1}}, &(0x7f0000000080)=0xe8)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r3, 0x89f7, &(0x7f0000000300)={'sit0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x2f, 0x25, 0x93, 0x80000001, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x7800, 0xffff, 0x5}})

04:38:16 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
userfaultfd(0x80800)
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffc000/0x3000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 4:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$VIDIOC_S_FBUF(0xffffffffffffffff, 0x4030560b, &(0x7f0000000100)={0xcc, 0x1, &(0x7f0000000180)="7477037da09c1f02b3af92e584364005c387eea610f9e6cf9118dde65e80b61fce8cd2e1c6c7ccf3800f49cf0487f7116ee01e9e20f10a4fa3a774314f3c40faaf88e032ee8a74dc6676739a49b0ff00ff0de9226cb4167abcb6704ecff831cea5e819bbdbe559d5c12e57f13fba09000800a33f2599955668f55a6502cfa272d677a5449b90fe47f5ddc1f46a8f0edb2cddb11de4971d256381e6", {0x3, 0x90, 0x32314247, 0x6, 0x1, 0xfffffff9, 0xa, 0x7}})
r1 = userfaultfd(0x100800)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x58})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x2, 0x2)
madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x9)

04:38:16 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:16 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x2, 0x4000, 0x800, &(0x7f0000ffc000/0x4000)=nil)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xff}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2c}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x101}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7f}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000890}, 0x48e73a60cb29c92d)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c004}, 0x4001)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:16 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ff3000/0xd000)=nil, 0xd000}, 0x2})
r1 = userfaultfd(0x80c00)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x2})

04:38:16 executing program 2:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 5:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:16 executing program 2:
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:16 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:16 executing program 4:
socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 3:
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0)
r1 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
r2 = userfaultfd(0x800)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x3})

04:38:17 executing program 4:
socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:17 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x2000)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 3:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:17 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 4:
socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:17 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:17 executing program 3:
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:17 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffb000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 3:
syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2)
r0 = userfaultfd(0x41000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x22})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:17 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:17 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:17 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 3:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})
r4 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x200003)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})

04:38:17 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000326bd7000fbdbdf250700000008000c000000000008001700", @ANYRES32, @ANYBLOB="c0bae311d913cf14dfd60000000000000000000000000000005e765d508a385919514113140a925fbdfb3bf8b58af1b6b745c275476a48762c1d12e12b85a717f94e55987f57018fbdf7060bfe936e2c0d1c1419ff13bb76b4d1245ae675cfc6e11ec5eca9f0a90a5be1f8d9fe2f3bea4aeb34ffc61591118c21e295aba68d1a40706f0ff5e06f94abdf52132bd28a78879bcef53da17e90a9f5fe3d565f0000006cc5a3ce55564f5698bd5d2ea6cc22e64bb1f5e50fb3f3fc2d"], 0x24}}, 0x4040)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x93834100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0xc0)
shmget$private(0x0, 0x1000, 0x80, &(0x7f0000ffd000/0x1000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r5 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r5, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 3:
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4c})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:17 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000000c0)={@dev, @multicast1}, &(0x7f0000000100)=0xc)

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 3:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
r0 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x1, 0x5f5c81)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x1})
inotify_rm_watch(0xffffffffffffffff, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:17 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:17 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000100))

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0)

04:38:17 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/sem\x00', 0x0, 0x0)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x1})

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x3, 0xe000, 0x1, &(0x7f0000fef000/0xe000)=nil)
socket$nl_rdma(0x10, 0x3, 0x14)
shmat(r0, &(0x7f0000ff9000/0x4000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$fb(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x2, 0x25130, 0xffffffffffffffff, 0x5b000)
msgctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000000)=""/70)
r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xf7dd, 0x40000)
ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f0000000140)={0x6, 0x100, 0x3, {0x4, 0x81, 0x400, 0x3dce}})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/bus/input/handlers\x00', 0x0, 0x0)
r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r3, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_LOG_STATUS(r3, 0x5646, 0x0)
r4 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x3, 0x2)
ioctl$VIDIOC_G_EDID(r4, 0xc0285628, &(0x7f0000000240)={0x0, 0xfff, 0xfd6e, [], &(0x7f0000000200)=0x40})
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}, &(0x7f0000000100)=0x10)

04:38:17 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:38:17 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0)

04:38:17 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:17 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockname$l2tp(r2, &(0x7f0000000100), &(0x7f0000000140)=0x10)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0))
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd26, 0x800, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x20004000)

[  788.442993] Bluetooth: hci5 command 0x0406 tx timeout
04:38:17 executing program 0:
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:17 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:38:17 executing program 5:
accept4(0xffffffffffffffff, &(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f0000000140)=0x80, 0x800)
r0 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f0000000180)="c4c3a96eb2ae0e00002bc744240005000000c744240200000000c7442406000000000f011c2466baf80cb8820adf82ef66bafc0c66edc4e3f17d21000f20e035000040000f22e0b9800000c00f3235000400000f30c4c19d573d0080000065660f38825b6cf08186663d80ee00c0fffff083a30000000000", 0x78}], 0x1, 0x21, &(0x7f0000000240)=[@efer={0x2, 0x400}, @cstype0={0x4, 0x6}], 0x2)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
move_pages(0xffffffffffffffff, 0x3, &(0x7f0000000000)=[&(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000040)=[0x10000], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$usbmon(&(0x7f0000ff8000/0x6000)=nil, 0x6000, 0xfc51ecaf9f6d0bd8, 0x10011, 0xffffffffffffffff, 0xfb30)
shmget$private(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil)

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})

04:38:18 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
connect$l2tp(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @loopback, 0x4}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0)

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:18 executing program 0:
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:38:18 executing program 1:
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 3:
ioctl$VIDIOC_S_JPEGCOMP(0xffffffffffffffff, 0x408c563e, &(0x7f0000000100)={0x7fff, 0x6, 0x2b, "23495787b9d4030de7de0b001b1684b2c8451c64f581e70a5269875ba6dd37c4a60cd8138029432f6484adcb063e75147b79a2741b0db62d4583d069", 0x20, "84fc9555b1bfcb08018f92e43b0dcb17026c88851afe708e7879ee3de219f4e6b2c8d3261cf9e887e2b65d5dafd1b02a51cf6a6886aa22c1d356eeeb", 0x28})
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000080)="0c5d4a5e4d35b42688ddabf73e453d5ae1ed0d11e35d9326eb14fc50446cf9369ffca1b863d35dbb5d1f51b7ca85f2d08b6e34", 0x33, 0x4004080, &(0x7f00000000c0)={0x2, 0x0, @multicast2, 0x1}, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil)
shmget(0x2, 0x1000, 0x54000000, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 4:
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 0:
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockname$l2tp(r2, &(0x7f0000000100), &(0x7f0000000140)=0x10)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0))
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd26, 0x800, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x20004000)

04:38:18 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r8 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r8, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 3:
ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000000c0)={0x0, @nfc={0x27, 0x0, 0x0, 0x3}, @l2={0x1f, 0x0, @fixed={[], 0x11}, 0x3, 0x2}, @in={0x2, 0x4e22, @loopback}, 0x4, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000080)='veth0_to_bridge\x00', 0x1000, 0x3, 0x1})
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000140)="6766c7442400ce0a0fdc6766c74424026a0000006766c744240600000000670f0114240fc7280f71f23a660f3adf5e42d464660fe40d66b98a0b00000f32f689c6940a66b80b0000000f23c80f21f86635080000000f23f8c05d0f000f01d1", 0x5f}], 0x1, 0x0, &(0x7f0000000200)=[@cstype3={0x5, 0xc}, @flags={0x3, 0x200000}], 0x2)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:18 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil)
shmget(0x2, 0x1000, 0x54000000, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockname$l2tp(r2, &(0x7f0000000100), &(0x7f0000000140)=0x10)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0))
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd26, 0x800, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x20004000)

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil)
shmget(0x2, 0x1000, 0x54000000, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockname$l2tp(r2, &(0x7f0000000100), &(0x7f0000000140)=0x10)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0))
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd26, 0x800, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x20004000)

04:38:18 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f00000000c0)={0x0, 0x6, 0xcdf6, r1, 0x0, &(0x7f0000000080)={0xa00901, 0xf563ea6e, [], @ptr=0x2}})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r3, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000140)=0x8)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffb000/0x3000)=nil, 0x3000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})

04:38:18 executing program 3:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x4f5120aa4dced285})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockname$l2tp(r1, &(0x7f0000000100), &(0x7f0000000140)=0x10)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000001c0))

04:38:18 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})
r4 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x200003)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x4000)=nil, 0x3000)

04:38:18 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 3:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = inotify_init1(0x800)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f00000001c0)="540f5241c27a8a519cefe77ead02738c8af72d1cd89c8e3e0016dfed576630eaddc45a26103d6406a0f5cc6d52540a562626db6884eb95e55a625cbbee676fab7279ef2d39e6e22f6114c15b1f26b5428ffa4ff10bcafbdd42f61fbe4238c97b6c02d215d38c348c6e05db8e395d4ae9fbc1bca49dedf9a2a348f97356f8a4ffd13ac8dde04ff22b274def69db6f9fc9c410c6b559bc9254771c21edcbed009651d6a72bc05856f13afb0835abb11b4fb2a013243bf892f51831a5d08ac2192fc0239d3dec6b054ddd4d8586ea6fa60de43df7a0cbc260", 0xd7, r1}, 0x68)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, 0x0, 0x4000081)
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3)
syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x2000000000, 0x40)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/zoneinfo\x00', 0x0, 0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r8 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r8, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockname$l2tp(r1, &(0x7f0000000100), &(0x7f0000000140)=0x10)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)

04:38:18 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})
r4 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x200003)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})

04:38:18 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget(0x0, 0x2000, 0x4, &(0x7f0000ffd000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockname$l2tp(r1, &(0x7f0000000100), &(0x7f0000000140)=0x10)

04:38:18 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})
r4 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x200003)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = semget$private(0x0, 0x2, 0x36a)
semctl$GETZCNT(r2, 0x4, 0xf, &(0x7f0000000000)=""/4096)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/tty/ldiscs\x00', 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000140)={'sit0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x4, 0xfe, 0x3, 0x5, 0x40, @loopback, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x40, 0x7, 0x9a, 0x4}})
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:18 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})
syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x200003)

04:38:18 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:18 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})
socketpair(0x3, 0x5, 0x4, &(0x7f00000000c0))

04:38:19 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r8 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r8, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x28})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r1, &(0x7f0000ffb000/0x2000)=nil, 0xd000)

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:19 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1})

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000})
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 3:
r0 = userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x8})
userfaultfd(0x180000)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:19 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r8 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r8, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r2=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
ptrace$getenv(0x4201, 0x0, 0x4, &(0x7f0000000000))
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = userfaultfd(0x800)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000180)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x4000})
r3 = fork()
r4 = syz_open_procfs$namespace(r3, &(0x7f0000000000)='ns/net\x00')
r5 = accept4(r4, 0x0, &(0x7f0000000200), 0x80800)
r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000280)='gtp\x00')
sendmsg$GTP_CMD_DELPDP(r5, &(0x7f0000000340)={&(0x7f0000000240), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r6, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_LINK={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_VERSION={0x8}]}, 0x2c}}, 0x0)
sendmsg$GTP_CMD_GETPDP(r5, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x43434378e8f94742}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x0, 0x34fb961316719945, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x35208b1cfa2c5142}, 0x1)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000740)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032dbd7000fddbdf25310000000800db006adace703c2d94f7caa49e87f56547c6205685947c46c72991eacf0b1b9f520e7d3c2e13a1ae2d8d7f479df94f08e6846d5f312cdcbc36f8706e3262e9944cf4e69f3185b95fddd3d635641a04d65123af2db580c9d05749696551c2375e5f27aee688a0ba035b198a3186561ce8fa930d2742302a3def2fa9cf0c151cc92ae34b32ea0e4392738d7ad6b18e8834d75c5bf9f99bf500f75e930592585c8540a6aadc99f597c526163814b663cdc01e", @ANYRES32, @ANYBLOB="080001005d0000000c0099000000000039000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008000)
r7 = accept4(r5, 0x0, &(0x7f00000005c0), 0x800)
ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f00000001c0)=0x9)
sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x64, r6, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_FLOW={0x6}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_MS_ADDRESS={0x8, 0x5, @empty}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_VERSION={0x8}]}, 0x64}}, 0x0)
ioctl$NS_GET_NSTYPE(0xffffffffffffffff, 0xb703, 0x0)
sendmsg$GTP_CMD_GETPDP(r1, &(0x7f00000008c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000840)={0x5c, r6, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @remote}, @GTPA_NET_NS_FD={0x8, 0x7, r4}, @GTPA_FLOW={0x6}, @GTPA_NET_NS_FD={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_FLOW={0x6, 0x6, 0x4}, @GTPA_I_TEI={0x8, 0x8, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x8800)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r6, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x880}, 0x40840)

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget(0x2, 0x4000, 0x200, &(0x7f0000ff9000/0x4000)=nil)
shmat(r1, &(0x7f0000ff9000/0x1000)=nil, 0x0)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x2, 0x2000, 0x200, &(0x7f0000ffb000/0x2000)=nil)

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r2=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 3:
sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, 0x0, 0x4, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3f}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x40000001}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7f}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000805}, 0x20004044)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0))
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000440)={@loopback, <r1=>0x0}, &(0x7f0000000480)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=@ipv6_delroute={0x4c, 0x19, 0x100, 0x70bd29, 0x25dfdbfb, {0xa, 0x20, 0x20, 0x81, 0xfc, 0x6, 0xfd, 0xa, 0x800}, [@RTA_GATEWAY={0x14, 0x5, @remote}, @RTA_MARK={0x8, 0x10, 0x2}, @RTA_MULTIPATH={0xc, 0x9, {0x8f, 0x4, 0xec, r1}}, @RTA_UID={0x8, 0x19, 0xee01}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x40880)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ff5000/0x3000)=nil, &(0x7f0000001000/0x2000)=nil, 0x3000})
madvise(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, 0x4000})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000200)="26660f73d20cbaf80c66b8dc2e798366efbafc0cb8123beff2af0f01cb66b99008000066b883d7303266ba000000000f3066b9800000c00f326635000100000f30f3e1000f07d06bf00f20d86635200000000f22d8", 0x55}], 0x1, 0x0, &(0x7f00000002c0), 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
userfaultfd(0x800)

04:38:19 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000000000)="a389198188fc1e3728f266a8e1b2ce992535081e5eebd0cce5a2caff5898b1f706e463fd6cbf00a9275d3c23dae51e75f13e90d1a64541b51fad9f30f5a4d2b7a46afbab7757792a9e9f3fb997b97ca40ac0f95e9a5bddea3c26220403811ba9b62173b149f858ed9f1f82465e4cf9b4804b62f12ebc62750744051d60edec75f4f0c70c99a7098a0f031d8f8d9921097b7df9e9f20a0b89de1c3bd10c51e34fd5bb200a1ac12aac7f08e3", 0xab}, 0x68)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4)

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:19 executing program 3:
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000080)={0x2, 0x0, 0x2016, 0xd65c, 0x7, 0x41, 0x4, 0x1})
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:19 executing program 5:
pkey_alloc(0x0, 0x0)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 1:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x3000, 0x1})
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:19 executing program 1:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 3:
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f00000000c0)=0x101)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x2})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8})
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000080)={0x43b, 0x2, 0x4, 0x83, 0xfffffff7, 0x8001, 0x7})

04:38:19 executing program 1:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffb000/0x3000)=nil, 0x1000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 3:
r0 = pkey_alloc(0x0, 0x1)
pkey_mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x300000a, r0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffb000/0x4000)=nil)
userfaultfd(0x80400)

04:38:19 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget(0x3, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil)
r1 = pkey_alloc(0x0, 0x1)
pkey_mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x100000a, r1)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:19 executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x1407, 0x800, 0x70bd25, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x40001}, 0x4000)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000180))
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x25, 0x2, 0x7b21c873, &(0x7f0000000140))
ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sysvipc/msg\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000100)={&(0x7f0000ffa000/0x4000)=nil, 0x4000})

04:38:19 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:19 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:19 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000100)=0x10)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})

04:38:19 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:19 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:20 executing program 3:
r0 = userfaultfd(0x800)
syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x1, 0x4000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:20 executing program 4:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:20 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
mlock2(&(0x7f0000ea6000/0x2000)=nil, 0x2000, 0x1)
shmat(r1, &(0x7f0000800000/0x800000)=nil, 0x3000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vim2m\x00', 0x2, 0x0)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000100)=0x10)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})

04:38:20 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r3, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r4, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 4:
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, 0x4000})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000100)=0x10)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:20 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffb000/0x3000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 4:
socketpair(0x0, 0x3, 0x200, &(0x7f0000000280))

04:38:20 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
mmap$usbmon(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x100010, r1, 0x7)

04:38:20 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
mmap$usbmon(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x50, 0xffffffffffffffff, 0x7e)
r1 = shmget$private(0x0, 0xc000, 0xc20, &(0x7f0000ff4000/0xc000)=nil)
shmget(0x2, 0xe000, 0x1000, &(0x7f0000ff2000/0xe000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x1, 0x200000)

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000100)=0x10)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x3, 0x200)
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}})

04:38:20 executing program 4:
socketpair(0x0, 0x3, 0x200, &(0x7f0000000280))

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:20 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000100)=0x10)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:20 executing program 4:
socketpair(0x0, 0x3, 0x200, &(0x7f0000000280))

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000, 0x1})

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000100)=0x10)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:20 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000080)={0xfffffffa, 0x320000, "b440b37c58aed0fa481af4af40f9b14fa6bc27c0c6ce25c5", {0xdc6b, 0xa816}, 0x5})
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x2000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000140)={0x1, 0x5, 0x4, 0x22a168d59314502a, 0x2, {0x0, 0xea60}, {0x2, 0xc, 0x67, 0x80, 0x8, 0x6, "3b990f33"}, 0x0, 0x2, @planes=&(0x7f0000000100)={0x5, 0x0, @userptr=0x5, 0x2}, 0x1000})
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, 0x0)

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:20 executing program 4:
socketpair(0x11, 0x0, 0x200, &(0x7f0000000280))

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x4000, 0x1})

04:38:20 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1)
r1 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffc000/0x3000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x8000)
msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$usbmon(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x80010, 0xffffffffffffffff, 0x2)

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, 0x0)

04:38:20 executing program 4:
socketpair(0x11, 0x0, 0x200, &(0x7f0000000280))

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x29, 0x0, 0x1, 0x0, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @empty, 0x80, 0x7, 0x1, 0xfffffffa}})
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000140)={'ip6_vti0\x00', r1, 0x0, 0x0, 0x40, 0xfffffc00, 0x41, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, 0x8000, 0xf, 0xfff, 0x6}})

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, 0x0)

04:38:20 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 4:
socketpair(0x11, 0x0, 0x200, &(0x7f0000000280))

04:38:20 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 3:
r0 = userfaultfd(0x400)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x77})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x0)

04:38:20 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:20 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4000})

04:38:20 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:20 executing program 3:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:20 executing program 4:
socketpair(0x11, 0x3, 0x0, &(0x7f0000000280))

04:38:20 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:20 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x4000, 0x4, &(0x7f0000ffc000/0x4000)=nil)
ioctl$VIDIOC_G_OUTPUT(0xffffffffffffffff, 0x8004562e, &(0x7f0000000000))
ioctl$VIDIOC_DBG_S_REGISTER(0xffffffffffffffff, 0x4038564f, &(0x7f0000000040)={{0x3, @addr=0x2}, 0x8, 0x8, 0x9})
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)='ns/net\x00')
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
userfaultfd(0x1000)

04:38:21 executing program 0:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:21 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 4:
socketpair(0x11, 0x3, 0x0, &(0x7f0000000280))

04:38:21 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
mmap$fb(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000006, 0x20010, r1, 0x100000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 0:
add_key$user(0x0, &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:21 executing program 4:
socketpair(0x11, 0x3, 0x0, &(0x7f0000000280))

04:38:21 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
socket$inet(0x2, 0x2, 0x9)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/consoles\x00', 0x0, 0x0)
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x1})

04:38:21 executing program 4:
socketpair(0x11, 0x3, 0x200, 0x0)

04:38:21 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 5:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 0:
add_key$user(0x0, &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:21 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:21 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x23})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@can_newroute={0x1c, 0x18, 0x100, 0x70bd27, 0x25dfdbfe, {0x1d, 0x1, 0x5}, [@CGW_CS_XOR={0x8, 0x5, {0x7, 0xfffffffffffffffd, 0xfffffffffffffffc, 0x80}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x90)

04:38:21 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 5:
ioctl$VIDIOC_DBG_G_REGISTER(0xffffffffffffffff, 0xc0385650, &(0x7f0000000140)={{0x1, @addr=0x6}, 0x8, 0x7, 0x8})
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000040)={0x6, 0x3, 0x3, {0x7683eeda0c54e161, @pix={0x5, 0x6, 0x32314d4e, 0x0, 0x8, 0x80000001, 0x3, 0x5, 0x0, 0x0, 0x1}}, 0x8})
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
socket$phonet_pipe(0x23, 0x5, 0x2)

04:38:21 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 0:
add_key$user(0x0, &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:21 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:21 executing program 3:
r0 = userfaultfd(0x80000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:21 executing program 0:
add_key$user(&(0x7f0000000000)='user\x00', 0x0, &(0x7f0000000080)="be9c9bd9500482c6fd0a163bc872312bbc17fe85d1c45a2b74887e78a31237d0dbb7a7f67847e5eeeac3391960e22fe1984dfa4d8df5cfeef7", 0x39, 0xfffffffffffffffa)

04:38:21 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:21 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
semctl$GETZCNT(0xffffffffffffffff, 0x2, 0xf, &(0x7f0000000000)=""/226)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:21 executing program 0:
add_key$user(&(0x7f0000000000)='user\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffa)

04:38:21 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:21 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget(0x2, 0x4000, 0x78000000, &(0x7f0000ff8000/0x4000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xffffffff00000000, 0x604000)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, 0x4000010, r2, 0x0)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ff5000/0x9000)=nil, &(0x7f0000ff6000/0x4000)=nil, 0x9000, 0x1})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 3:
msgrcv(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000062b9b901b3bc430102f9ed9856dcd3dde200cc98791501"], 0x2f, 0x0, 0x1000)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000fee000/0x12000)=nil, 0x12000}, 0x2})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x3a})

04:38:21 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:21 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:21 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:21 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:21 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:21 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:21 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:22 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x2)
r2 = socket$inet6(0xa, 0x1, 0x1081)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/consoles\x00', 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f00000001c0)={0x3, 0x6, 0x4, 0x80000, r4})
r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r5, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EDID(r5, 0xc0285628, &(0x7f0000000140)={0x0, 0x80, 0x6, [], &(0x7f0000000040)=0x3})
ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000100)={0xa20000, 0x7, 0x2, r2, 0x0, &(0x7f00000000c0)={0x9a0915, 0x8, [], @ptr=0x1daf}})

04:38:22 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)

04:38:22 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)

04:38:22 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:22 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)

04:38:22 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:22 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f00000000c0)={0x980000, 0x5, 0x2, r0, 0x0, &(0x7f0000000080)={0xa20954, 0x9, [], @ptr=0xfffffffffffffc01}})
clock_getres(0x5, &(0x7f0000000100))

04:38:22 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)

04:38:22 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x2000)=nil, 0x1000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
mmap$fb(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x2010, r2, 0x2d000)
r3 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@qipcrtr, &(0x7f0000000080)=0x80, 0x800)
getsockopt$PNPIPE_IFINDEX(r3, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:22 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 3:
r0 = userfaultfd(0x80000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}]}, 0x24}}, 0x20000010)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:22 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)

04:38:22 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:22 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)

04:38:22 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = semget(0x3, 0x2, 0x604)
semctl$GETVAL(r1, 0x1, 0xc, &(0x7f0000000000)=""/74)
semctl$GETVAL(r1, 0x3, 0xc, &(0x7f0000000000)=""/228)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:22 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4081}, 0x4000010)

04:38:22 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)

04:38:22 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 2:
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 5:
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x0, 0x14, &(0x7f0000000000)=""/145)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:22 executing program 3:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/vmallocinfo\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x44}}, 0x4004001)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:22 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)

04:38:23 executing program 2:
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget(0x1, 0x800000, 0x78000a98, &(0x7f0000800000/0x800000)=nil)
shmat(r2, &(0x7f0000c82000/0x4000)=nil, 0x2000)

04:38:23 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_QUERYMENU(r1, 0xc02c5625, &(0x7f0000000040)={0x0, 0x0, @value})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:23 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)

04:38:23 executing program 2:
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 3:
r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0)
r1 = userfaultfd(0x80000)
r2 = syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x2, 0x2)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000280)={0x9d0000, 0xfffffffd, 0x101, r2, 0x0, &(0x7f0000000240)={0x990a60, 0x8001, [], @ptr=0x1}})
clock_gettime(0x0, &(0x7f00000000c0)={<r3=>0x0, <r4=>0x0})
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000100)={0x7f, 0x0, 0x4, 0xe000, 0xdb3d, {r3, r4/1000+10000}, {0x2, 0x8, 0x4, 0x0, 0x8, 0x9, "df80693f"}, 0x3, 0x3, @fd=<r5=>r0, 0x200})
ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f00000002c0)={0x9e0000, 0x8001, 0x1000, r5, 0x0, &(0x7f00000001c0)={0x9b090f, 0x8, [], @p_u8=&(0x7f0000000200)=0x3f}})

04:38:23 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}})
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 4:
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)

04:38:23 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:23 executing program 2:
syz_open_dev$vcsa(0x0, 0xff, 0x20000)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x8000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1})
userfaultfd(0x0)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 4:
msgrcv(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x3000)

04:38:23 executing program 3:
semget$private(0x0, 0x4, 0x1)
r0 = userfaultfd(0x0)
userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:23 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 4:
msgrcv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3000)

04:38:23 executing program 2:
syz_open_dev$vcsa(0x0, 0xff, 0x20000)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xf000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
socket$nl_route(0x10, 0x3, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x1, 0x2000, 0x8, &(0x7f0000ffb000/0x2000)=nil)

04:38:23 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
userfaultfd(0x80800)

04:38:23 executing program 4:
msgrcv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:38:23 executing program 2:
syz_open_dev$vcsa(0x0, 0xff, 0x20000)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 0:
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0xe})

04:38:23 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000009, 0xffffffffffffffff)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:23 executing program 0:
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x5})
syz_open_dev$usbmon(&(0x7f0000000240)='/dev/usbmon#\x00', 0xffffffff, 0x10000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
sendto$l2tp(r2, &(0x7f0000000600)="f60f595b8cd7835a156c29b7e95d7f0ae5f81535c59e4dbfa84b9f2f2c729115109054f4f5fe11daba63a7c0b199460d530158b23ae444b34affda1dc93beb9afc86ed872d5cbf55f7bada6bfdc9c3047ae55046a9076ade1e432a59202ea98897644f84e6c586ad26141e0c4efce324c259a3ebd7dcf5dc9878c1229997eebf44161efaedaf5034aae80ed81721b0fe15ad65b305d2e689f7cdab7bdbf4a9453e4e445cf47b564488255324f32ccaee6c07b1e54d4e4ace9b4f263328ba3ed457925268b2ab8d114662e809bd464098d6a10c00d4e50147b16bdd520ac5eb2f223f84ced566b5544700c52b7dfc244742725b74f474ff730b7e9016c6489f6db79e597a5d411e1d1bb8476765c8c4423f27eaabb5e271676a9eb759d0b8ed995c1470ae5eaae48850880112785b8073bda06ff9667d1c6da4f1e8ba922455239a051d1b1037e000ca489c39d17cf8ac7d03f02ed8a66de69d08ce9a0d3f008fdff96e6ca50c5a3e6d34c00186dbeafe456ef00fe2e8df5bed7a0025a7dbd50542704cf3728de80ba5eaf51963b06bf8473d627872d7f0a9b1df22a541b58701a940f3c554724e28a0211522cf7024597fe37352ae5067ea09a59d001d29861b87fc58f2360854617b42bb30ab6a61cf002618cadc04b793e97f0f34a8484e7d0c8b01734f88bb5c5e445a4cdd9c7c735676613f564d73a349ecfaa3ea2b23f761af9ff2ec54fb85f860f5f90ef5ff719474446ca0b97e14f8652e43c28ff4806cd86844e981b9063beb5fde6aacb58322f80984c679d1b411b482beae4df04296d01017cb33905b1835a31d29285fe76a59e7f6fe5a892a9986c393b8b443efbbd75e7d065c018252c7c0b8f78d4ae688f42e330bf3cb028a0c64ed7318f0fb8e9962e50df3c29abe953bb2bfeee829069b2287d7b740320a7f08bf554e4a677e34c48fd4312ce7638b4a206e04ba02e6fa869dcdbf506c6bcb7b365178f8bcbece685a1834fe8eff27b1ecfd014d48742ae830cf2ce4ecda3d6454c79929a6e51e20067a2c39627bf75827565847642b713f07453611b32a09c0364086e2bac29ad256baac91fcc99d10eed0b51990ff1295ed40362396d41f941db44cc95604e6dcf7172ecac477e06feb890328ca2179d93c2aebc96b72193e69a455dcd8c2a6c6deea7bce19b5d7dfffbbd29532b5f245048bcba69cdaa94c6965c8961686c4d444381d78a5e3e1ee285b7df78316a682136078c46c200a209070e526a7faf8a28cdeef7b1c8b8b1fdd48f38bae9bfe92c9632961668ca74fcdd61511832f24b633beb8b70b7ba7b9da3c4dfac86a6f639d364117caf0322557606f949afc54672ba927febda12ccc02113b763d2aaede4a43f790ec08004d59c7d30690b8c01e5abdb7378ad7d056c705329270e3489692dd6ad5ea429e9c99dcde5af0a41e379379935eb2d53f2c8fa665df629e36ed81a722979aa1679e2e1756d0a08c5705cbf595979fd98f4f4088151cc97c1cb1b8fccfc1b34486151834d880345523ec29c4e64727b0cc651b0620c9324e23e51c2c5e1f1806af7bca2adecaf6e254e4315887509ffdcfa25a5e643a2a8aca3074feb631710a1124b1b750fe635c7eeb6c941a7fff5780e88b3c2568489f037c6906b0a48dd10d4acd2a3936217eab165efcf3857a9c2fc479f635fc7bdd161ab58e48e251923e3a728e7f3db69fc8ed69fa37c46a91b0ea1ce4ab561c8f2a88721e752a88c906193f1a013705d78d93eb3e05924f8144b20d47b0fd0d2bda48f612feea4209e08fab164f9a11a5a8d86ac30a5239768cbf0b9e97e040eb2abc0453c900ca7d50757d079f219e30069005b6a6b196c252539b30659e45cb7487d4f8da8271dc3de416dab1bc02e79d222be535323dab9cad6b707b3caba5952a315fd69971317003a6a1e8db8bcd217aa0c9bd5ae8b5179d4b80446ec909774125677b1e25be92ed57a628bb3e1067c248a2c87aa9527afdaeb4e01a20dc35bb15575e85f11895ea8ce119fd2aef66e267e5d5c95965b10d05a0c06beb13c3b0a229a3906023e8992a418c4c8240b15b52d206edc633806696ef8503535d22dc4de2bea3e574b2405a010b52501432b766629a92b514e9e36133a6b0d2046956f615a06c1ef6d111892258342c31e20e06aeca0a65eac2baccf91118058009460eacdbd4426c9be4207b3232dd955256652c5186a2f64a5387b97edd4b4c0f50d4fd4692ba970fac1a6e37f55706eacf458c306459423305ea496c229f4a7e2f0095bb2074dc47358a49ca6ce0cadc28a3c5be896eb15d00aa0c814a79c1bba221c36058fb505346b4a150e5fb210e4337bafe1af7b40ed2756dc3f2375ac220be18637cbe2f6792328635147043c95f80fb9f8536be7eb0f0adaa4b4c4ed5830ec604edcf08e07b38e46ab74e40f8f4092979438d30c642f88f7bb7d74d70255a090478f8d857311ee6ede95fd2488f716761befa655c3d7d806954f253919bbe17072863c35fb70d9a6ac72f7e1ac853ea9b1a094eba4a08be1fd411434b979c4f901c9ca42534494c36c8b8ce6d734045704566f256b8c9cbd14fc1071dc575db57da50a80f8a6e89f083b4d9dffa8fda909514fe491df3cb6c4420324ee0e24476726d3ad2de1c39e47dc84822e8f30ae8f596019b53d4222a0b580a86e17c6dc68906bf27db08492d1f7b7f52c058c774f61a4ea3ef76194095b170a9e33b113c70f6359925ac2729c5d9d47ded06f34aa0275bddd302aec2e1ba056dfabf569511b7a6c12452d98836196ec8754ccc20eda3e7a62bfb7d5233c0c6821e5b84479e021f1e1de9204abac83f0fb9c72383adca72d506e6fe010dc6958e5de7cfed52d7904fe91e967d93445935f98093e0608d14d16457ce0656dbf32fbcf1f77afb3ef1e7e48c950ba114c29f9e6aa33c564f1c0bbc24cf4f8a25daaabb55ffe955b91933b1bad51e2163f3bf8427106d0def398c71bd1439c3871e2fd6102f46ae8ce610d23f4cff98750340548ead4fdc5d30f59ed82d52e9fed18e3195cedf2a6132e5bccf065407a0aa61ec0ecdf4697f5113ae948627796b8ad026be9f5a2f8e2afabe5eae0f989b9b3fee6f6c7696b22a3a836e194ac91057047d83c114bf7c6f91681dcd1ba2ac962e11c07edf04c215a76b30d32401f8d411ea39ac241c3df62d5bcd4c624d54cf09b9d85a9f3e5310f1948aac1281158a5fcdd12b9f42dd3204088c1b1371518ff50e598655231055414096c9e2cae119dc44bf8581b0696d900a49c1855596d4e738e56b3a072c0434df73084ce2ef85e8f9a76f1b342ea74d2aa212b8af5d6e6a1b23b6bde4bb1657b13124291075f58f7d9c2e38d1d14ef19a0c28dc6842a2e782c0ab4950fd473018915f2110dcc19bdda31fc9eb8082653eea0ff50ab76c44cf770514461db7ebaf87a056160fbe6fd6c865a844118fdb8137850adc524b8560004e356f2dd848ee89caf230caea7b2233e6dee3d1840957bd539712113340f7886bb6abc018c3658a47d973ad3378aa7f8607e6c3eaf0afb55ef39f814a956ab2ada33f6ae1e6a3750ee214befdb245cb15cb9673ed359ebbb472ec56927765c11cccc79ebb0507b64ffdcd77be8ab464ee970ccad279931a1e00fc39aa8f2910e072249710998c879bf5451b18f243bc2c0a3c264a221e00bec21521fe3faf1c2b1ce5a604ad3428a4207e44ebcb51ea100994740bff7648afb86e69abef0f117c8fc6e5a2b34868137eb85c715ed8793aa78841e52cbdae9d0036d37b600580e07618088b3e890d399a1be5622899ce605bcd5f5069a584a6c2ba09cf4397e63573977e9e019995714892fb8222958f47fdc1553eaa873b896368330a3f0acf82c23c14c622e184103c95e4a064d5c6689517dda6d4926cdf4f7a1e0f20867873ef8737d6998435ddd85f2a517153090ddc326a659f445284a67eaffdec21b141ac7ec0ae71a4b7067d82445a10fb26d6db49372f2322d4d1f2aa64a6d04a3244f25a22713eaa673e20f8d04a95c8d635fcb01bc46b66d8eae9491425d2cb9e5c6b5e4d18deadcb123fd79f81cc11dbbc6ef918aa0c3a4f3c16710e39fa25d740331ae9b64c953f2b7a9a8746f0ae95922df93375adfc09ed68148c44a94344b442d38c76c4a0c5fb7ff0bbbb7407749c15a4bf56b5e19bc6e8f8894f7d4b508c4416e4b6029bc9aeb638af984ddfc61f0744e66f380dc171da8a34e205e340d997fb0885563ce65d9a3f29cee7e229986e43be79050df07a1af402286fdbdbdaaeb2cfc8555c33c2f55f398ee5e8ec20b701171358d00a40ba2aabb0b172a23e7c0a0ab254290f44b470682b20200790257d03c9052ff74e198fb584529866dd819b61fa95ae6aad45a0dddc5050d13a2bb6441221f4095adea14365b447767a7466910168e075bafea747c66b9de069f2de4c82b69a623dff966a17e68e2da7830cb51db1c38a4d098d3098ee5f146e4dfded634a66b44027b3441670008e08b6c409cd023498ff33842d7f8766704ff0691daf95c55e8710a1effb6b91339182bba96d8ade86bc452de455a1685b5a20b922e32c4b4a811c20e49ea85e5c55e5ece79ab7a0213f2a36fc92bb7f1de761d9e0344305d9e7936dba89d468c39fb176cffd0312468b9600562ac23d3b36a80e03396eda02f67cff2e7c25cc1e5fb8369f18aced4252d2b5adcd4541b9a000d148b53a8fb272ade77ba736efa3c9cc394426aa8a3f34e4fd301a5a1801fcf55f42368c018eb92863affe63c9c3c1c1638ddd9757d1e1ba09f3b5b9be5453acdfcc3146ba641b38aea534e81cdf8de7b28dbe276ea0e0bf43f07a120d6409f0ba3cd84086947cf76d3301e321a307c86f6f2b0eb1a5d539f7fdd9df46358ab8d1897434da1f824948a9004a26c2dbae3d82fb5d60d79e5fb022bb0c464da18b9a66b6a8da1b9c2d5367de7a78a88f740a6f6e796c76c41ba466d44d3df0894e19629496c18e8954b67aa5d6ff3360bbee50a5d4080059d84f292f914904d84471cc85df9fd82f831f50d47513ca804d8cc506d43789b82e2c987b5ceceb25a39ea5d7256e5f1cdd0697b2b0861a519b09579ff121ed4cb1d7b6638a6088110d8bb349339b055929e6259ff535f2b0afc4279792c0c4841861f195e650ea7bc3d876e5aea1978b0c65b9a5275bfdd05db691205a55ff188ca1dac554efad040aeb7c93ed1fbdb96f75c8421379ebe6a552b5d187aa34d91dd54a8451b55bcfbd0d819020170c83767c5db22155c1aaf14ad3f254a9951e29900f149e2b90b5bafac03896bf9dd734c9c7094a39eed0ae40b71879322724295eec553d8fe7f58c616eb9d52ead9d7860bbd7d4db46a74e58e664c92fc0c10e8235020c464f24c9d89ee56a339011fbc74a94c0c4db8794eede5664665b1e5c6775f13cd06dea3a7070f2511eb9a6d913cb41d9b941d1128b385d7846ad8952d9985331ce6e7c2b7b3e9aa4cb0981ba6c618acc4d003988dc89b65b79279b597f11e8dd316c9abeb3fd967294b6418347dd176105b0a2b162f023d3f0f46941b932fee6e1fbfda2a66bccb00cc8ad00084811b5f8b97a3e4e11271d2c53a1b7a08f235b1476e045e78842d315645c3dccd3ae4e14761c324aea19e7f1f9c68c6a32167075a96d89bd7b19acb9c5cecdcfc5f7317db8786847b8e8a7379f5d1a2543da17af43df8bea19f79f0eae1f925d5fd076e196b065fc8d7d6b7a03e69575399a1d0a66fe78d7cc1b3fe8b10909b782", 0x1000, 0x20040814, &(0x7f0000000200)={0x2, 0x0, @multicast1, 0x2}, 0x10)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100)='l2tp\x00')
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, r5, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0xc000)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x38, r3, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x60004000)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:23 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x20000)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ff9000/0x3000)=nil)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffd000/0x2000)=nil, 0x2000})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 0:
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}})

04:38:23 executing program 0:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
munmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x40, 0x0)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:23 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:23 executing program 3:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x6, 0x420000)
ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1000})
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000140)=0x401)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000100)={&(0x7f0000ff0000/0x10000)=nil, 0x10000})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}})

04:38:24 executing program 0:
clock_gettime(0x0, 0x0)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x1, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
ptrace$getenv(0x4201, 0x0, 0x5, &(0x7f0000000000))

04:38:24 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x800, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 4:
clock_gettime(0x6, &(0x7f0000000080))
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, r1, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3ff}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x8084}, 0x8040)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x9})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff5000/0xb000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f00000000c0)="61b1f8cd1f904349d29cde2b8a3db4d11fa229abe3f7391b44576c4981703a8554479b44f21af386daca7dd771412059818e385aca81bac2b2f465a3288b84098254eee6f3d9ed44e87ed9777ff116bc4594e2b95436f5695d2b15ac0798dcea0b9dfc1770a8e88937bb375de85ed5448f7b7463dcf2e3462c4e292626f85808ed8612456c6f8b0a6765c5ae9b8d50e59b27d4a9e9dd48e97f82d09e334985857b88c361104b45565feabd1aadbb24196a0a", 0xb2, r2}, 0x68)

04:38:24 executing program 0:
clock_gettime(0x0, 0x0)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 4:
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 0:
clock_gettime(0x0, 0x0)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
ptrace$getregs(0xc, r1, 0xcf3, &(0x7f0000000200)=""/188)

04:38:24 executing program 4:
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 0:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 4:
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 0:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffd000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$VIDIOC_S_OUTPUT(0xffffffffffffffff, 0xc004562f, &(0x7f0000000040)=0x2)
msgctl$IPC_STAT(0x0, 0x2, &(0x7f0000000000)=""/5)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil)

04:38:24 executing program 0:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 3:
ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
userfaultfd(0xc0800)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
ioctl$NS_GET_USERNS(r2, 0xb701, 0x0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_GETPDP(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000025bd7000fddbdf2502000000060006000200000008000700", @ANYRES32=r2, @ANYBLOB="65e1829fdcbdf4b1fb4ac35fbd38f1cfbb61a0c101691c704e3018839d6e6f6bd72de8967b6bc4fe7bf48dfbffbd7198f3ab345655656d69b06913ef08ca13f2eecd42fbbd5b5aa08af3636eca97d55e17939d111f30f524586496d8bc3c5d7e18a4d039a07f5baf3982c6b9670f0ea2c9823c840d"], 0x24}, 0x1, 0x0, 0x0, 0x4004}, 0x1)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 4:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4)
sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1080}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001a0002d5226e3501ad36652580148081ff01ff04003a0000e774d40f23183fe49ec183d22a3ac0ca62ec774cf6674a83eb83612a24e5d3cf3340553031e50362acf70ba3012809fcf601fa681938e2c1f649960f078b7b3d5fe52a2baa600ef0a4e0e5f8a11a1ddf3cd3d4ab3cdb0e4d8cbb9fca18c9d282597a39856a18ccfc42ce8059"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffc000/0x3000)=nil, 0x5000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 2:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 3:
r0 = userfaultfd(0x100800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x4000, 0x1})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2})

04:38:24 executing program 4:
clock_gettime(0x0, 0x0)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, r1, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3ff}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x8084}, 0x8040)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x9})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff5000/0xb000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f00000000c0)="61b1f8cd1f904349d29cde2b8a3db4d11fa229abe3f7391b44576c4981703a8554479b44f21af386daca7dd771412059818e385aca81bac2b2f465a3288b84098254eee6f3d9ed44e87ed9777ff116bc4594e2b95436f5695d2b15ac0798dcea0b9dfc1770a8e88937bb375de85ed5448f7b7463dcf2e3462c4e292626f85808ed8612456c6f8b0a6765c5ae9b8d50e59b27d4a9e9dd48e97f82d09e334985857b88c361104b45565feabd1aadbb24196a0a", 0xb2, r2}, 0x68)

04:38:24 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
userfaultfd(0x80000)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:24 executing program 4:
clock_gettime(0x0, 0x0)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 2:
clock_gettime(0x6, &(0x7f0000000080))
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 4:
clock_gettime(0x0, 0x0)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:24 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:25 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1f, 0x40)
r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x138ad7e, 0x1010a1)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000080)="66ba2100edb9800000c00f3235001000000f30f30fa7e0360f01cab932060000b82d9e5e8cba000000000f30c4e14572e49c66b8c2000f00d066ba430066edf30f22646765f30f58ce", 0x49}], 0x1, 0x6, &(0x7f0000000140)=[@efer={0x2, 0x1}], 0x1)
r3 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r3, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r4 = semget$private(0x0, 0x2, 0x4)
semctl$GETVAL(r4, 0x3, 0xc, &(0x7f0000000180)=""/233)

04:38:25 executing program 3:
r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x0, 0x2)
ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f00000000c0)={0x200, "317fbf7e77f9807a607162037010db95804b85ac90aea4dbe11b0745fe11cdb0", 0x1, 0x1})
r1 = userfaultfd(0x0)
ioctl$VIDIOC_ENCODER_CMD(r0, 0xc028564d, &(0x7f0000000100)={0x1, 0x0, [0x0, 0x5, 0x7, 0xe5, 0x0, 0x1, 0x101, 0x1f]})
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x1, 0x2)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:25 executing program 4:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:25 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:25 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0xc4)

04:38:25 executing program 4:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:25 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 3:
r0 = socket$inet6(0xa, 0x1, 0x8)
ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000140)={0x4, 0x5, 0x3})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x9, 0x7f, 0x0, 0x40, @local, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x80, 0x8, 0xfffffc00, 0x40}})
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000180)={@initdev, @multicast1, <r2=>0x0}, &(0x7f00000001c0)=0xc)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000200)={'ip6gre0\x00', r2, 0x2f, 0x1, 0x2, 0xfffffffa, 0x2, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x700, 0xc0d1169, 0x10000}})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:25 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:25 executing program 4:
clock_gettime(0x0, &(0x7f0000000080))
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:25 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xc000)
r1 = shmget(0x1, 0x1000, 0x800, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffe000/0x1000)=nil, 0x1000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x5, 0x0, &(0x7f0000ff9000/0x3000)=nil})
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1)

04:38:25 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)
socket$phonet_pipe(0x23, 0x5, 0x2)

04:38:25 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0xc4)

04:38:25 executing program 4:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x6, 0x420000)
ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1000})
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000140)=0x401)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000100)={&(0x7f0000ff0000/0x10000)=nil, 0x10000})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}})

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0x4000)
munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'ip6tnl0\x00', <r2=>0x0, 0x2f, 0xfd, 0x1f, 0x9891, 0x0, @ipv4={[], [], @empty}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8000, 0x1, 0x4}})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f00000000c0)={'syztnl2\x00', r2, 0x4, 0x2, 0x4, 0xfb96, 0x44, @remote, @dev={0xfe, 0x80, [], 0x2a}, 0x7, 0x78a7, 0x7fffffff}})

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xc000)
r1 = shmget(0x1, 0x1000, 0x800, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffe000/0x1000)=nil, 0x1000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x5, 0x0, &(0x7f0000ff9000/0x3000)=nil})
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1)

04:38:25 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)

04:38:25 executing program 3:
r0 = userfaultfd(0x800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x7000)=nil, 0x1000})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@private2, @in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@private0}}, &(0x7f0000000180)=0xe8)

04:38:25 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xc000)
r1 = shmget(0x1, 0x1000, 0x800, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffe000/0x1000)=nil, 0x1000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x5, 0x0, &(0x7f0000ff9000/0x3000)=nil})
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1)

04:38:25 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}})

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
semctl$GETZCNT(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000000)=""/149)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x4000)

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xc000)
r1 = shmget(0x1, 0x1000, 0x800, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffe000/0x1000)=nil, 0x1000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x5, 0x0, &(0x7f0000ff9000/0x3000)=nil})
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1)

04:38:25 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)

04:38:25 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:25 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)

04:38:25 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}})

04:38:25 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xc000)
r1 = shmget(0x1, 0x1000, 0x800, &(0x7f0000ffb000/0x1000)=nil)
shmat(r1, &(0x7f0000ffe000/0x1000)=nil, 0x1000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x5, 0x0, &(0x7f0000ff9000/0x3000)=nil})
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1)

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
wait4(r1, &(0x7f0000000000), 0x1, &(0x7f0000000040))
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)

04:38:25 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
semctl$GETZCNT(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000000)=""/149)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x4000)

04:38:25 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ff9000/0x3000)=nil)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffd000/0x2000)=nil, 0x2000})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@getlink={0x70, 0x12, 0x10, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40000, 0x7924}, [@IFLA_CARRIER_CHANGES={0x8, 0x23, 0x1}, @IFLA_TARGET_NETNSID={0x8, 0x2e, 0x1}, @IFLA_VFINFO_LIST={0x28, 0x16, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x2, 0xfffffff9}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x7, 0x100000000}}]}]}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_EXPECTED_FD={0x8}]}, @IFLA_BROADCAST={0xa, 0x2, @link_local}]}, 0x70}}, 0x1)

04:38:25 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000009, 0xffffffffffffffff)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:25 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}})

04:38:25 executing program 2:
shmget$private(0x0, 0x3000, 0x6773adab42687f13, &(0x7f0000ffb000/0x3000)=nil)

04:38:25 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:25 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000009, 0xffffffffffffffff)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:25 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x5000, 0x40, &(0x7f0000ff9000/0x5000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:25 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x3000, 0x1})

04:38:25 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1})

04:38:26 executing program 2:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)

04:38:26 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x28, 0x14, 0x1, 0x70bd25, 0x25dfdbff, {0x2, 0x38, 0x40, 0xfe}, [@IFA_BROADCAST={0x8, 0x4, @private=0xa010101}, @IFA_ADDRESS={0x8, 0x1, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x8010}, 0x2400c800)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:26 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8000000000009, 0x5200)
syz_genetlink_get_family_id$devlink(&(0x7f00000026c0)='devlink\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
recvmsg$can_bcm(r3, &(0x7f0000002640)={&(0x7f0000000080)=@tipc, 0x80, &(0x7f0000002480)=[{&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/241, 0xf1}, {&(0x7f0000001200)=""/55, 0x37}, {&(0x7f0000001240)=""/2, 0x2}, {&(0x7f0000001280)=""/109, 0x6d}, {&(0x7f0000001300)=""/151, 0x97}, {&(0x7f00000013c0)=""/127, 0x7f}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000002440)=""/12, 0xc}], 0x9, &(0x7f0000002540)=""/253, 0xfd}, 0x42)
ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000002680)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x3000, 0x1})
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2000})

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000009, 0xffffffffffffffff)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 1:
syz_open_dev$vcsa(0x0, 0xff, 0x20000)
fork()
fork()
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:26 executing program 2:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r1, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x4}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7f}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, r2, 0x29b0ea14d8c235a8, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000340)={0xaa, 0x12})

04:38:26 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000000040)="b426913515afc3430170ac53b5cfef676f481d9fb189cdd744d86a07168fc181416874", 0x23, r2}, 0x68)
sendmsg$GTP_CMD_GETPDP(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="090025bd7000e5dbdf2502000000080007006ce424a575df159f957b1b7dbaeee6e866a8b8bb824c4ea9df65050620c7af8dc403dc1131ec1ac8e82361e0229e3a9763ecdf949f248982ae31cb1b60e05d97bccd91e963c63d35b6060b4477f1b6593669bbbb065acf8e27ed2e0ad4e0989124623721c55c0a79867d44448c004c62c608b91cf96acc4f1380e675d223e11fd4f100"/161, @ANYRES32, @ANYBLOB="0c0003000200000000000000080004000000000008000400640101010600060001000000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x8000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:26 executing program 2:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 3:
r0 = userfaultfd(0x0)
r1 = socket$inet(0x2, 0x4, 0x80000000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffb000/0x1000)=nil, 0x1000}, &(0x7f0000000140)=0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x1000})
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ff6000/0x9000)=nil, 0x9000}})
r2 = pkey_alloc(0x0, 0x2)
pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, r2)

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
r0 = userfaultfd(0x0)
userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000000040)="b426913515afc3430170ac53b5cfef676f481d9fb189cdd744d86a07168fc181416874", 0x23, r2}, 0x68)
sendmsg$GTP_CMD_GETPDP(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="090025bd7000e5dbdf2502000000080007006ce424a575df159f957b1b7dbaeee6e866a8b8bb824c4ea9df65050620c7af8dc403dc1131ec1ac8e82361e0229e3a9763ecdf949f248982ae31cb1b60e05d97bccd91e963c63d35b6060b4477f1b6593669bbbb065acf8e27ed2e0ad4e0989124623721c55c0a79867d44448c004c62c608b91cf96acc4f1380e675d223e11fd4f100"/161, @ANYRES32, @ANYBLOB="0c0003000200000000000000080004000000000008000400640101010600060001000000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x8000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 3:
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x3})
ioctl$VIDIOC_DBG_S_REGISTER(0xffffffffffffffff, 0x4038564f, &(0x7f0000000080)={{0x4, @name="2912d12ac42a84d1ea72982f9b471f5c5597a50000000000000010262f00"}, 0x8, 0x8000000008, 0x2})
r0 = pkey_alloc(0x0, 0x0)
pkey_mprotect(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x100000e, r0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x2000800)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040))
r3 = userfaultfd(0x181000)
ioctl$UFFDIO_ZEROPAGE(r3, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
r0 = userfaultfd(0x0)
userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 5:
semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, &(0x7f00000000c0)=""/20)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x1000, 0x40, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}, &(0x7f0000000140)=0x10)
r2 = fork()
move_pages(r2, 0x1, &(0x7f0000000000)=[&(0x7f0000ff9000/0x4000)=nil], &(0x7f0000000040)=[0x1, 0x4, 0x3ded, 0x1ff, 0x1, 0x4, 0x8], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2)

04:38:26 executing program 3:
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, 0x3000})
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000000)={0x1, 0x544f})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})

04:38:26 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
r0 = userfaultfd(0x0)
userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 0:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:26 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 0:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
r0 = userfaultfd(0x0)
userfaultfd(0x80800)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0)
mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_G_TUNER(r3, 0xc054561d, &(0x7f00000000c0)={0x3, "44bcdf89d1b7b659d68775007e5782450da25e41385da6cdb56e7e68e59f82f0", 0x3, 0x810, 0x1000, 0x4, 0x4, 0x2, 0x4, 0x8001})

04:38:26 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 3:
userfaultfd(0x0)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffb000/0x2000)=nil, 0x2000})
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
socketpair(0x8, 0xa, 0x7, &(0x7f0000000000))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000280)={0x2, 0x2, 0x1ff, 0x800, r1})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000001c0)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f00000000c0)="6b7908ee7bc412e7cea3b681d17b94d0a1a04fa59066faffe10e6b0ebeaf189f4f838d3d2b75ff2bf237389d611000e735f9119ed149788ec20b3c3e3e38f20fdb45ab41e24a53fb926dcaf613fd006d7419bd7b1f6b5fd2411c656609fae7665055efde565189264f25dc6d524d38c07ffef62deafc7e82e9fed88cd1ff956376a40594019329aba9102cb3eb5494dcd302e605014cb14ed98dec9224d2ff21c7b812773334222f4939e544a37cc0ae3a1d628cb7f4a70add6fff951ce9324a19c9e18d4e8c60f567f85ee00af9c82502dd850bbc2449705e0f", 0xda, r0}, 0x68)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x27})
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x8d8)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x5})

04:38:26 executing program 0:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
userfaultfd(0x0)
userfaultfd(0x80800)
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
userfaultfd(0x0)
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x2000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:26 executing program 3:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/seq/clients\x00', 0x0, 0x0)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, 0x1000})
syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00')
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}})

04:38:26 executing program 4:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:26 executing program 2:
semget$private(0x0, 0x4, 0x1)
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:26 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 4:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:26 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000800000/0x800000)=nil, 0x4000, 0x1})
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffd000/0x1000)=nil, 0xf000)

04:38:26 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:26 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 4:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 2:
add_key$user(0x0, &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffd000/0x3000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r3 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r3, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:27 executing program 2:
add_key$user(0x0, &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 2:
add_key$user(0x0, &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffb000/0x2000)=nil, 0x2000})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x2000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffd000/0x3000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:27 executing program 1:
shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x1000)=nil, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x7})

04:38:27 executing program 1:
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:27 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x4000, 0x10, &(0x7f0000ffc000/0x4000)=nil)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000040)={0xd39, 0x1, 0x4, 0xe000, 0x8, {0x0, 0x2710}, {0x0, 0x8, 0x40, 0xa, 0x7f, 0x5, "d0c375c3"}, 0x80, 0x4, @offset, 0x1000, 0x0, <r2=>0xffffffffffffffff})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000800000/0x800000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ef1000/0x4000)=nil, &(0x7f0000000000), 0x0, r2}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msync(&(0x7f0000930000/0x2000)=nil, 0x2000, 0x1)

04:38:27 executing program 1:
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x0)

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:27 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)

04:38:27 executing program 1:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x4000, 0x80, &(0x7f0000ffc000/0x4000)=nil)
msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}})
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$can_bcm(0x1d, 0x2, 0x2)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xb000)

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:27 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)

04:38:27 executing program 3:
shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:27 executing program 1:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:27 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:27 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:27 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
msync(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xa800)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)

04:38:28 executing program 3:
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:28 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}})

04:38:28 executing program 1:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:28 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffd000/0x2000)=nil)
shmat(r0, &(0x7f0000ffb000/0x3000)=nil, 0xb000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
mmap$usbmon(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x200000b, 0x10, r2, 0x1)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00')
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14080000", @ANYRES16=r4, @ANYBLOB="000127bd7000ffdbdf251000000008003b000100008008000b00ff7f000005002e000100000005002a0001000000"], 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x8000)
shmget$private(0x0, 0x2000, 0x400, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1)
r5 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r6, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_NOOP(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r6, 0x810, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0xc044)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00')

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:28 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}})

04:38:28 executing program 3:
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0x0)

04:38:28 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
msync(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xa800)

04:38:28 executing program 1:
add_key$user(0x0, 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
msync(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x4, 0x3, 0x2, 0x1, 0x9fc27e3922aebdcf, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8000, 0x8000, 0x4b58235a, 0x80000000}})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffa000/0x2000)=nil, 0x2000})

04:38:28 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}})

04:38:28 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:28 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 1:
add_key$user(0x0, 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:28 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
semctl$GETVAL(0x0, 0x2, 0xc, &(0x7f0000000000)=""/240)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:28 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:28 executing program 1:
add_key$user(0x0, 0x0, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c1d5e05a485d109b7bab130570dfb0b55ac01303f24f7a259a5152f9763e01d07be51a2dd13411d3f1010e42e597f8d5c701d808c6819c79b0ae5d82058ef653cc2945a26d563fdc948deec54da6b9c8b60ba37dbffe2df4304deefe6b3aa28", 0xbe, 0xfffffffffffffffe)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea9038e70273838ac9252972ab25880c9dbc0c26fcbf77ab7cb4da6c3749b5a902b91f918391d8011129b1a67d096d5112c", 0x5f, 0xfffffffffffffffe)

04:38:28 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:28 executing program 1:
add_key$user(&(0x7f0000000080)='user\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r1, &(0x7f0000ffd000/0x3000)=nil, 0x262c33cc93572303)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffc000/0x4000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:28 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
shmat(0x0, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:28 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:28 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0)
mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_G_TUNER(r3, 0xc054561d, &(0x7f00000000c0)={0x3, "44bcdf89d1b7b659d68775007e5782450da25e41385da6cdb56e7e68e59f82f0", 0x3, 0x810, 0x1000, 0x4, 0x4, 0x2, 0x4, 0x8001})

04:38:28 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:28 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x4000, 0x8, &(0x7f0000ffc000/0x4000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}})
r3 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x100000a0)
inotify_rm_watch(r2, r3)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
inotify_rm_watch(r4, r3)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:28 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0)
mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_G_TUNER(r3, 0xc054561d, &(0x7f00000000c0)={0x3, "44bcdf89d1b7b659d68775007e5782450da25e41385da6cdb56e7e68e59f82f0", 0x3, 0x810, 0x1000, 0x4, 0x4, 0x2, 0x4, 0x8001})

04:38:28 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0)
mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1})
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_G_TUNER(r3, 0xc054561d, &(0x7f00000000c0)={0x3, "44bcdf89d1b7b659d68775007e5782450da25e41385da6cdb56e7e68e59f82f0", 0x3, 0x810, 0x1000, 0x4, 0x4, 0x2, 0x4, 0x8001})

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="334022899ea9068c7fc7315a81342988476231d4b7790f6c5d3ef70aedb17434f76b15151e7e97e6699a6e3a55eea903", 0x30, 0xfffffffffffffffe)

04:38:28 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 0:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:28 executing program 4:
semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, &(0x7f00000000c0)=""/20)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget$private(0x0, 0x1000, 0x40, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}, &(0x7f0000000140)=0x10)
r2 = fork()
move_pages(r2, 0x1, &(0x7f0000000000)=[&(0x7f0000ff9000/0x4000)=nil], &(0x7f0000000040)=[0x1, 0x4, 0x3ded, 0x1ff, 0x1, 0x4, 0x8], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2)

04:38:28 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)='3', 0x1, 0xfffffffffffffffe)

04:38:28 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 3:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:28 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:28 executing program 0:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:28 executing program 3:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:29 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:29 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 0:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:29 executing program 4:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x1000)=nil, 0xd000)

04:38:29 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:29 executing program 3:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:29 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:29 executing program 2:
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe)

04:38:29 executing program 4:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
setuid(0xee00)

04:38:29 executing program 4:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:29 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 0:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:29 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 4:
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:29 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 0:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 4:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 2:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:29 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x4000)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:29 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget(0x1, 0x800000, 0x78000a98, &(0x7f0000800000/0x800000)=nil)
shmat(r2, &(0x7f0000c82000/0x4000)=nil, 0x2000)

04:38:29 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:29 executing program 4:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:29 executing program 2:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:30 executing program 0:
r0 = userfaultfd(0x80000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}]}, 0x24}}, 0x20000010)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})

04:38:30 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil)
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:30 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil)
shmat(r1, &(0x7f0000ffb000/0x2000)=nil, 0x1000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
mmap$fb(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x2010, r2, 0x2d000)
r3 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@qipcrtr, &(0x7f0000000080)=0x80, 0x800)
getsockopt$PNPIPE_IFINDEX(r3, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:30 executing program 4:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:30 executing program 1:
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x0)

04:38:30 executing program 2:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:30 executing program 0:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)

04:38:30 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:30 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:30 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:30 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:30 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:30 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:30 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:30 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:30 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:30 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:30 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:30 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:30 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:30 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:31 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:31 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:31 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:31 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:31 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:31 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:31 executing program 5:
mmap$dsp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4014c31, 0xffffffffffffffff, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:31 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:31 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:31 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:31 executing program 5:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:31 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:31 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:31 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:31 executing program 5:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:32 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:32 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:32 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:32 executing program 5:
clock_gettime(0x6, &(0x7f0000000080))
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
msgrcv(0xffffffffffffffff, &(0x7f0000000000)={0x0, ""/69}, 0x4d, 0x3, 0x3000)
r1 = shmget(0x3, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:32 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:32 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:32 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:32 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)

04:38:32 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
r6 = fork()
syz_open_procfs$namespace(r6, 0x0)

04:38:32 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:32 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:33 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:33 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:33 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:33 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
fork()

04:38:33 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:33 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:33 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:33 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:33 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
fork()

04:38:33 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})

04:38:33 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:33 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
fork()

04:38:33 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:33 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)

04:38:33 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:33 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:34 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:34 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})

04:38:34 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:34 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:34 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r4 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r4, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)

04:38:34 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)

04:38:34 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:34 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)

04:38:34 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:34 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:34 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})

04:38:34 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()

04:38:35 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r4 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r4, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:35 executing program 5:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:35 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:35 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r4 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r4, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)

04:38:35 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:35 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})

04:38:35 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:35 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:35 executing program 5:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:35 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:35 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()

04:38:35 executing program 5:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:36 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:36 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:36 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:36 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:36 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:36 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})

04:38:36 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:36 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:36 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
fork()

04:38:36 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:36 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:36 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:37 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:37 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:37 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()

04:38:37 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:37 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
fork()

04:38:37 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)

04:38:37 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:37 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:37 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()

04:38:37 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:37 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:37 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:38 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:38 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r4 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r4, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)

04:38:38 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:38 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:38 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r1, 0x9)

04:38:38 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:38 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r1, 0x9)

04:38:38 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)

04:38:38 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()

04:38:38 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:38 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:38 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)

04:38:39 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:39 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1})

04:38:39 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)

04:38:39 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)

04:38:39 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:39 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()

04:38:39 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:39 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:39 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:39 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:39 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:39 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:40 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:40 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:40 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:40 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:40 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:40 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:40 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:40 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

04:38:40 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:40 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:40 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:40 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:40 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
fork()

04:38:40 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:40 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:41 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:41 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}})

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()

04:38:41 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:41 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:41 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r1, 0x9)

04:38:41 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:41 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:41 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:41 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:41 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r1, 0x9)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:41 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:41 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:41 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:41 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:41 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:41 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:41 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:42 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:42 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:42 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:42 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:42 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:42 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:42 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:42 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:42 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:42 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:42 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:42 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:43 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:43 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:43 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:43 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:43 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:43 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:43 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:43 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:43 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:43 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:43 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:43 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:44 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:44 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:44 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:44 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:44 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:44 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:44 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:44 executing program 2:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:44 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:44 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:44 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:44 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:45 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:45 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:45 executing program 2:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:45 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:45 executing program 5:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:45 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:45 executing program 2:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:45 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:45 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:45 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:45 executing program 5:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:45 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:46 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:46 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:46 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:46 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:46 executing program 5:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:46 executing program 1:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:46 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:46 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:46 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:46 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:46 executing program 2:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:46 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:47 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:47 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:47 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:47 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:47 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:47 executing program 1:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:47 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:47 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:47 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:47 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:47 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:47 executing program 3:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:48 executing program 4:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:48 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:48 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:48 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:48 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:48 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:48 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:48 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

04:38:48 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:48 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:48 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:48 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:49 executing program 4:
fork()
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:49 executing program 5:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:49 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:49 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:49 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:49 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)

04:38:49 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:49 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:49 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()

04:38:49 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:49 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)

04:38:49 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:50 executing program 4:
fork()
wait4(0x0, 0x0, 0x40000000, &(0x7f0000000140))

04:38:50 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:50 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r1, 0x9)

04:38:50 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:50 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r4 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r4, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)

04:38:50 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:50 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r4 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r4, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)

04:38:50 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:50 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:50 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:50 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:50 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:51 executing program 4:
fork()
wait4(0x0, 0x0, 0x0, &(0x7f0000000140))

04:38:51 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x0)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x6000)

04:38:51 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:51 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:51 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:51 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:51 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:51 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:51 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:51 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:51 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(0x0, &(0x7f0000fff000/0x1000)=nil, 0x0)

04:38:51 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)

04:38:51 executing program 4:
fork()
wait4(0x0, 0x0, 0x0, &(0x7f0000000140))

04:38:51 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x0)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:51 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
fork()

04:38:51 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)

04:38:51 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
wait4(0x0, &(0x7f0000000100), 0x40000000, &(0x7f0000000140))

04:38:51 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})

04:38:52 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)

04:38:52 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:52 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:52 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:52 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x5000)
shmat(r0, &(0x7f0000ffd000/0x3000)=nil, 0x2000)
r1 = shmget$private(0x0, 0x2000, 0x20, &(0x7f0000ffb000/0x2000)=nil)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0)
mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x9)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
fork()
r3 = fork()
syz_open_procfs$namespace(r3, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r5 = fork()
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042bbd7000fddbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=r5, @ANYBLOB="904d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20004005)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x3000})
fork()

04:38:52 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)
shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x0)

04:38:52 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(0x0, &(0x7f0000ff8000/0x2000)=nil, 0x4800)
shmat(r1, &(0x7f0000fff000/0x1000)=nil, 0x6000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:52 executing program 4:
fork()
wait4(0x0, 0x0, 0x0, &(0x7f0000000140))

04:38:52 executing program 1:
socketpair(0x11, 0x3, 0x0, &(0x7f0000000280))

04:38:52 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:52 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:52 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:52 executing program 1:
socketpair(0x11, 0x3, 0x0, &(0x7f0000000280))

04:38:52 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:53 executing program 1:
socketpair(0x11, 0x3, 0x0, &(0x7f0000000280))

04:38:53 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:53 executing program 1:
socketpair(0x0, 0x3, 0x0, &(0x7f0000000280))

04:38:53 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
socket$nl_route(0x10, 0x3, 0x0)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
fork()
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r3, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r4, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:53 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:53 executing program 4:
fork()
wait4(0x0, 0x0, 0x40000000, 0x0)

04:38:53 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x0)

04:38:53 executing program 1:
socketpair(0x0, 0x3, 0x0, &(0x7f0000000280))

04:38:53 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:53 executing program 0:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
userfaultfd(0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280))

04:38:53 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000})
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:53 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r1, &(0x7f0000ffb000/0x2000)=nil, 0xd000)

04:38:53 executing program 1:
socketpair(0x0, 0x3, 0x0, &(0x7f0000000280))

04:38:53 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:53 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000})
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:53 executing program 2:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})

04:38:53 executing program 0:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})

04:38:54 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget(0x0, 0x2000, 0x4, &(0x7f0000ffd000/0x2000)=nil)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:54 executing program 2:
ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r0 = userfaultfd(0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
socketpair(0x11, 0x3, 0x200, &(0x7f0000000280)={<r3=>0xffffffffffffffff})
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x53010}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_macvtap\x00'}]}, 0x5c}}, 0x10)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0xa9})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
ioctl$sock_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, @vsock={0x28, 0x0, 0xffffffff, @hyper}, @ipx={0x4, 0x307, 0x2, "33b2c6b98bce", 0x5}, @xdp={0x2c, 0xc, 0x0, 0x2f}, 0x7, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)='macvtap0\x00', 0x3, 0x3, 0x5})
syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x200003)

04:38:54 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r0, &(0x7f0000ffb000/0x1000)=nil, 0x5000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:54 executing program 1:
socketpair(0x11, 0x0, 0x0, &(0x7f0000000280))

04:38:54 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000})
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:54 executing program 4:
fork()
wait4(0x0, 0x0, 0x40000000, 0x0)

04:38:54 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r2, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmat(r2, &(0x7f0000ffb000/0x4000)=nil, 0x3000)

04:38:54 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r8 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r8, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:54 executing program 1:
socketpair(0x11, 0x0, 0x0, &(0x7f0000000280))

04:38:54 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xff, 0x20000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
r3 = fork()
r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r4, 0xb703, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/consoles\x00', 0x0, 0x0)
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000580)='l2tp\x00')
sendmsg$L2TP_CMD_NOOP(r5, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c01d4ef", @ANYRES16=r6, @ANYBLOB="000329bd7000fedbdf2500000000050007000200000008001800ac141417060001000000000005000d00010000000600020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@RTM_GETNSID={0x5c, 0x5a, 0x2, 0x70bd28, 0x1, {}, [@NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8, 0x2, r2}, @NETNSA_PID={0x8, 0x2, r3}, @NETNSA_FD={0x8, 0x3, r4}, @NETNSA_NSID={0x8, 0x1, 0x4}, @NETNSA_NSID={0x8, 0x1, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1000c080}, 0x20000040)
r7 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r7, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r7, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r8 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r8, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:54 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:54 executing program 1:
socketpair(0x11, 0x0, 0x0, &(0x7f0000000280))

04:38:54 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x2000)

04:38:54 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:54 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:54 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:55 executing program 1:
socketpair(0x11, 0x3, 0x0, 0x0)

04:38:55 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:55 executing program 4:
fork()
wait4(0x0, 0x0, 0x40000000, 0x0)

04:38:55 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:55 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:55 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:55 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:55 executing program 1:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:55 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:55 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x2, 0x4000, 0x800, &(0x7f0000ffc000/0x4000)=nil)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xff}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2c}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x101}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7f}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000890}, 0x48e73a60cb29c92d)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c004}, 0x4001)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:55 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:55 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:55 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)
r3 = socket$inet6(0xa, 0x5, 0x1)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@private0}, 0x0, @in=@multicast1}}, &(0x7f0000000080)=0xe8)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r3, 0x89f7, &(0x7f0000000300)={'sit0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x2f, 0x25, 0x93, 0x80000001, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x7800, 0xffff, 0x5}})

04:38:55 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x9000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:56 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:56 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r2, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:56 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:56 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:56 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)
r3 = socket$inet6(0xa, 0x5, 0x1)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@private0}, 0x0, @in=@multicast1}}, &(0x7f0000000080)=0xe8)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r3, 0x89f7, &(0x7f0000000300)={'sit0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x2f, 0x25, 0x93, 0x80000001, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x7800, 0xffff, 0x5}})

04:38:56 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x12)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:56 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:56 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:56 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
socket$inet_smc(0x2b, 0x1, 0x0)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:56 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:56 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)
r3 = socket$inet6(0xa, 0x5, 0x1)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@private0}, 0x0, @in=@multicast1}}, &(0x7f0000000080)=0xe8)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r3, 0x89f7, &(0x7f0000000300)={'sit0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x2f, 0x25, 0x93, 0x80000001, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x7800, 0xffff, 0x5}})

04:38:56 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:56 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:56 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)

04:38:56 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:56 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)

04:38:56 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)

04:38:56 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)
socket$inet6(0xa, 0x5, 0x1)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@empty, @in6=@empty}}, {{@in6=@private0}, 0x0, @in=@multicast1}}, &(0x7f0000000080)=0xe8)

04:38:56 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:56 executing program 5:
r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:56 executing program 3:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)

04:38:56 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:56 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:56 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r3 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r3, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)
socket$inet6(0xa, 0x5, 0x1)

04:38:57 executing program 3:
shmget(0x0, 0x2000, 0x240, &(0x7f0000ffb000/0x2000)=nil)

04:38:57 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:57 executing program 5:
shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffb000/0x2000)=nil)
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
socket$l2tp(0x2, 0x2, 0x73)

04:38:57 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:57 executing program 3:
shmget(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:57 executing program 5:
munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)

04:38:57 executing program 3:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
socket$l2tp(0x2, 0x2, 0x73)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:57 executing program 5:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:57 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r2, 0x1000)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r1, 0x1000)

04:38:57 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)

04:38:57 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x3})

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r1, 0x1000)
r2 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r2, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 2:
syz_emit_vhci(0x0, 0x0)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, 0xffffffffffffffff, 0x1000)

04:38:57 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x3})

04:38:57 executing program 2:
syz_emit_vhci(0x0, 0x0)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, 0xffffffffffffffff, 0x1000)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r1, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x3})

04:38:57 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2})
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:57 executing program 2:
syz_emit_vhci(0x0, 0x0)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, 0xffffffffffffffff, 0x1000)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r1, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0x80c, 0xfffffffc)
recvfrom$l2tp(r1, &(0x7f0000001140)=""/4096, 0x1000, 0x2000, &(0x7f0000001080)={0x2, 0x0, @dev}, 0x10)
r2 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:57 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:57 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="b8292200000f23c00f21f835020006000f23f83e0f78dfc4c29d456e00c7442400f5ffbffec7442402bef00000c7442406000000000f0114240f01c8c4c30902100067660fc7b2c0e98fcac8124e3600000000b8010000000f01c1440f20c03507000000440f22c0", 0x68}], 0x1, 0x1, &(0x7f0000000100), 0x0)

04:38:57 executing program 2:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r1, 0x1000)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
socket$inet(0x2, 0x80c, 0xfffffffc)
r1 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r1, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)

04:38:57 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r1, 0x1000)

04:38:57 executing program 0:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r1, 0x1000)

04:38:57 executing program 4:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r1, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:57 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:57 executing program 1:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:58 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:38:58 executing program 2:
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)
r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:58 executing program 0:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 1:
userfaultfd(0x0)
r0 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:58 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:58 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)
shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000)

04:38:58 executing program 4:
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:58 executing program 2 (fault-call:0 fault-nth:0):
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:58 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:58 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)
shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0xd000)

04:38:58 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

[  828.730548] FAULT_INJECTION: forcing a failure.
[  828.730548] name failslab, interval 1, probability 0, space 0, times 0
04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(0x0, 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 4:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

[  828.800804] CPU: 1 PID: 32608 Comm: syz-executor.2 Not tainted 4.14.218-syzkaller #0
[  828.808766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  828.818123] Call Trace:
[  828.820742]  dump_stack+0x1b2/0x281
[  828.824372]  should_fail.cold+0x10a/0x149
[  828.828559]  should_failslab+0xd6/0x130
[  828.832564]  kmem_cache_alloc_node+0x263/0x410
[  828.837182]  __alloc_skb+0x5c/0x510
[  828.840816]  vhci_write+0xb1/0x420
[  828.844372]  __vfs_write+0x44c/0x630
04:38:58 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

[  828.848099]  ? kernel_read+0x110/0x110
[  828.852000]  ? rw_verify_area+0xe1/0x2a0
[  828.856064]  vfs_write+0x17f/0x4d0
[  828.859608]  SyS_write+0xf2/0x210
[  828.863063]  ? SyS_read+0x210/0x210
[  828.866700]  ? __do_page_fault+0x159/0xad0
[  828.870946]  ? do_syscall_64+0x4c/0x640
[  828.874924]  ? SyS_read+0x210/0x210
[  828.878560]  do_syscall_64+0x1d5/0x640
[  828.882455]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[  828.887642] RIP: 0033:0x418cef
[  828.890825] RSP: 002b:00007f1d645a4150 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(0x0, 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 4:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:58 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

[  828.898534] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000418cef
[  828.905804] RDX: 0000000000000002 RSI: 0000000020000000 RDI: 00000000000000f1
[  828.913103] RBP: 00007f1d645a41d0 R08: 0000000000000000 R09: 0000000000000000
[  828.920371] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
[  828.927641] R13: 00007ffcfe80cc1f R14: 00007f1d645a4300 R15: 0000000000022000
04:38:58 executing program 2 (fault-call:0 fault-nth:1):
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:38:58 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil)

04:38:58 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x8470)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(0x0, 0x2067, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 4:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, &(0x7f0000000400)=0x10)

04:38:58 executing program 5:
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:58 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x8470)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

[  829.103833] FAULT_INJECTION: forcing a failure.
[  829.103833] name failslab, interval 1, probability 0, space 0, times 0
[  829.138201] CPU: 1 PID: 32651 Comm: syz-executor.2 Not tainted 4.14.218-syzkaller #0
[  829.146123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  829.155566] Call Trace:
[  829.158187]  dump_stack+0x1b2/0x281
[  829.161831]  should_fail.cold+0x10a/0x149
[  829.165989]  should_failslab+0xd6/0x130
[  829.169970]  kmem_cache_alloc_node_trace+0x25a/0x400
[  829.175089]  __kmalloc_node_track_caller+0x38/0x70
[  829.180023]  __alloc_skb+0x96/0x510
[  829.183678]  vhci_write+0xb1/0x420
[  829.187223]  __vfs_write+0x44c/0x630
[  829.190949]  ? kernel_read+0x110/0x110
[  829.194853]  ? rw_verify_area+0xe1/0x2a0
[  829.198945]  vfs_write+0x17f/0x4d0
04:38:58 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x8470)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

[  829.202492]  SyS_write+0xf2/0x210
[  829.205953]  ? SyS_read+0x210/0x210
[  829.209605]  ? __do_page_fault+0x159/0xad0
[  829.213841]  ? do_syscall_64+0x4c/0x640
[  829.217812]  ? SyS_read+0x210/0x210
[  829.221462]  do_syscall_64+0x1d5/0x640
[  829.225363]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[  829.230555] RIP: 0033:0x418cef
[  829.233739] RSP: 002b:00007f1d645a4150 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[  829.241582] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000418cef
04:38:58 executing program 5:
userfaultfd(0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x20000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, &(0x7f0000000400))

04:38:58 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)

[  829.248936] RDX: 0000000000000002 RSI: 0000000020000000 RDI: 00000000000000f1
[  829.256212] RBP: 00007f1d645a41d0 R08: 0000000000000000 R09: 0000000000000000
[  829.263482] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
[  829.270751] R13: 00007ffcfe80cc1f R14: 00007f1d645a4300 R15: 0000000000022000
04:38:58 executing program 2 (fault-call:0 fault-nth:2):
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:38:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:58 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, &(0x7f0000000400))

04:38:58 executing program 3:
syz_emit_vhci(0x0, 0x0)

04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1000009, 0x40010, r0, 0x1000)

04:38:58 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x8470)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:58 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:58 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x1000)

04:38:58 executing program 3:
syz_emit_vhci(0x0, 0x0)

04:38:58 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, &(0x7f0000000400))

04:38:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(0x0)
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:58 executing program 2:
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0xc, 0x5, 0x0, 0x4800})
syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="03c900b6269926b4d0f79b5b5c6d1c6b4cdb36f940a88c2c07b0c0470e8fdcf15c51e73af4cba27b453c256d691b74b5c484cc7ce3aa11a538d2357048ab9e2b5ab23394ac00af2685c78b23461d0e127ee7abaea61bedc3b80b4eb98c6aed40b731fe468fe737fb31cba9aed23c09255001e7ad867deea2bac2900c8b76331aee2993eb69472470f0526122c89a0176f13b3780b8b417f63e8f64b954f3a6901da932d11f1efc41b89bd80efbcb08087c36defea1413c2f190d7f16f3b8554ee5000ae77983944342036c8e61e7a8cc5d2ca3c546756e74da1512b81d73bb153bb90486807f987bf883e3eabd223623a01ca68b0f37d6946a33493e194fd17af6bc251bbf54ca4675a86dc3f10e098aa322ef03419c0d7daff39f24e99da7c13102e13cfb782b03d1c5e2b955d6c544ce3b24f1ba7482d361"], 0xba)

04:38:59 executing program 3:
syz_emit_vhci(0x0, 0x0)

04:38:59 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(0x0)
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 1:
socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:59 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x10, r0, 0x1000)

04:38:59 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_simple_pair_complete={{0x36, 0x7}, {0x4, @none}}}, 0xa)

04:38:59 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:38:59 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(0x0)
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 1:
socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:59 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x10, r0, 0x1000)

04:38:59 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 2:
madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x65)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}, 0x1})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @empty}]}, 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x8000)
mmap$perf(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000008, 0x4010, r0, 0x40)

04:38:59 executing program 3:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x10, r0, 0x1000)

04:38:59 executing program 1:
socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:59 executing program 2:
semctl$SEM_STAT_ANY(0x0, 0x4, 0x14, &(0x7f00000000c0)=""/245)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0201404500410001000b031100ff000001495763a4e54e3b8e9c34228b3a0c80050001000500010e04030080000306030400003e0e000000000000008c4b0d060800f9ff05000200b942"], 0x4a)

04:38:59 executing program 4:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, 0xffffffffffffffff, 0x1000)

04:38:59 executing program 3:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 2:
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/ipc\x00')
r1 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0)
r2 = fork()
syz_open_procfs$namespace(r2, 0x0)
sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x8c, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r1}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r1}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x804}, 0x20000c0)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:38:59 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

[  829.867555] Bluetooth: hci2 ACL packet for unknown connection handle 1
04:38:59 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x10, r0, 0x1000)

04:38:59 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000010c0)={@broadcast}, &(0x7f0000001100)=0xc)

04:38:59 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, 0xffffffffffffffff, 0x1000)

04:38:59 executing program 3:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x6, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000002100)={0x0, @ipx={0x4, 0xa03, 0x8, "d932a8fd1810", 0x4}, @ipx={0x4, 0x4, 0x84, "10c4c007eb41", 0x3}, @nl=@kern={0x10, 0x0, 0x0, 0x20}, 0x1000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x10001, 0x4, 0x6})
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000020c0)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1})
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="03c900003d819f16d5d7948446f044996296df7f61d4bf0c29de5b9b2da697b57668c7d1107ce648075f0fdc7c6aeab57fb80f6a09687dc041f55e025a90901c10d9211022e5e3df76d88694910061e7def07ae52c90b2345824f40d4ce556187694e5abb76c9743205145a1586d3e8d0c92f5cdaebddad455eba59d7b84a40929bbf6175ffdd853a0a0d8175f7a3fab4f7b572902062a73c1c31c464609617e3052cadfe8df847957b41fe7b8b349a36672257bc067825b0b3ec8e2edd7b7a37a4ea343f36bc782296bc5ec4a08ebc0d6916e1c5d652d96a4b1a19593ef323cb8204af7096d6c23470d66f76d02f9ebb34a5537593ce25460876e333b62f3d8be5ded8068ed2a8cc1e62a39ee1e409607e3b1fb1bddc7d712a9adaad343716aa4f99d3afeaed0b0ec9833ecb61350782efd0ebc0c3eda2dba5d0952532c453702507e01b2e699da4123a36688fb2e802125d0f65c45debb6b5fe8edbd1d4927d35277814e0943ba428518e65666c1443e5708caaadfc95514e9d947c8eeed007bfd5ec8e05f0a3ce5bb20b96daad41c27fbba68b6cde612a910221b31e9f139ec8f673c21169918fe462b5a03bb95807fc5c9e6d26100b3f5e3b00b4973072bac0a694bae4c76e87e949d740ef1e33fcf65f13b5a3530de85d49008f85414e3cfd17ae0d80ca321c1c3f605e88c86208f3ba706dc2e185279a74bda1c167a8be5bfe3cf2b4a2cfba96306376c41a022ee847f5340171e5f0808b2e674f637501c794b54358a4d71d133bfc880ff0d7c0601c59a1522bc862b3fe54ab1c129643836837641c0310b550b3a3cb6d88e0ae59a2fad2eab8c429490cbbd1c017ad0428ea30e78fc6fb493ffe32fde02b7acbeb3d2d8560d166d989e20468ded1b37ad062819469028d0b524c555b1b3a36cb98a6867315d1f4c3144be7b49fec6e5f6480bdd4d99ac5dea30a5b31b92d1d02a677493cdd34bf23cf354784059d30b156570805369a520043a840979870114bea2d718088921ccd4243218f9b3fa0cfbc67d51393389d17e5eebef833800645e27fb7ce6038065e5dd093c0f490ab7725a1a90e661a87006998e038e66b9e0fe0b3ba436ada638397245f30f24e41a7192c772be089947cacdf5fdef5fb70de28b95a8ba6221f22272c852b8b23cc69c50f9ce08824504949236524dabacddae8e6ddcb323159193c43f769ea9b14c68d31b989a58384e28bfcabadc5c9881b3f38abfeb3fd36e5d40aab773506d5ba65ceed08627bd0305cc8ad75add664a35bbc2345720bee22ebe771881f7eaa6bd378c1a4dca38606fd5aa4676787fe80ac73e68232b5518bcd31d62d165baa423a1e8c29d118d8d7755daabdf019e12631d2f1a601dbfba0ade824df767887c121c6bb77712c50688f5dd9fc3cecf2108b62e331e204533e2a1791cd97472ecf3c6641c93801b7eab10380cf7a4ca8a7c3b41ecf2e6149e53b7a4d877969165ea6856eaf0ad9624cdd6e753e4f264b38062ce21a8efe71f1b5ad6ee51034386df5c6c6eb55d83e2b51978b1df3ed2cc014457d6fd21d5beabdf6d5368c736919d925d9927e01ebff499fcabb73ecb9fd1e8275cafb8b84057dba63eb013adb5faff48bf4939b0a5a11d092ab780cd735c6bf604f343ade942ea163c9883419f80b83203f5882c13ee68fa2df01002d040ede4bac5da0ccdf13b93c747f148c176aed5b66580e0e918a002fc6588117957f57a3fd0b37e262b979c6798fa394b188b3775ab88ed74dfcf3334009bd342077a839c15975ef74a4670279d89b3c66914947ccdcb7d3063875495afaa459c53675931f0de72587100897866cab0dfefedbc9556970719d9d8c11e6079ab4f08c1805e73117a6b49ffefe006dfff5f7afeb4075431c0667d074a59265168a2aedad9527135c269c0bf5587fbe9f545261bd43d37a591dc573ae3fcb921a8359cd8369447cd1858313a8d0bd09b593d31985be5644900830e4cd8959d6721904090a802226b2bd3186a6fc1ddf34769c45639ff863948417b793d63e74561f02eee95e6270a1ac0d72ddf98d6a25d6aa35c857f12fd28358cbbf56f23df72fcb5016dc0f638ee3d29c258764cd2e4b7d544c600668db684f3b66ff644ff456e07dac08e96696b1c3356e7b52beb41917a9395d1664df8cecdf58ce79f1c72be8ea87cb8a822e33a0481e925fa6a4e683e3c2af6427d6ce9ad4bab687904dd13fd1f081db2165211f75b26b885e9f5bd6b7379f87139180360269eb2aed6010816a831d3279a65a307f62423ce232ae153caf93cd48db46e79f8cc4c2cc57472816808c7244b44e594fc125a934b87929df2c22742def2e52e188e72fe344fda9fffba03d54c681cdee53a2998e0ee00ecacfe5d60a54de0ec901c4e00afbf48ad1c2c37205bf8f421e9cca52b1ed6fe828b88bcc646ca0f5ad4d996d7a2412e52cab83538cb3e801032f9a682d1956dfbfdc0b7f9a7dd905a33ec0ff719454122cc4ab9441477f86e09f2077a859ec6273adeb517c37d59852d83d8c52ebb827f5f4d5bab721aea0a60bcd4d8e8dee96c635fe138880cfbdb077d4fae0ce4a65db87bfaa9c1a498814ab34463b350f59e3495b4a5a08a31e12a902654592bfd37ef0f8e8fd0316349d14e3c3c629d6b1caa24ff9ea5cac82a5c8cd4cd133592c3c144e74b45e5266f03703217dca564603dfd5f5f2c651dbd551b73d33e9a90541d513539bd493be51ef99552fe94c9d854070f3596b2e524283f617b01829cdbc6ff7093230e0da042181738f6f5e664825963dcb2374f2e04e586c7d35373d6b820cf89df9efb49e7dfaa3231df73c6adb01d7e384e4dcce8c8970ea361d6fda300e222257bf5fbcaf5c9023e830a975cccd0f28c56f272ab6dda4ddb75ccb5bc2005c03183558764c65a7b22995fde05de6059d4a7a7a600cfe0b44be594ead924561a27c535be337dca2192c3b9ec23b9e2876045974ff040f744a82157d05ec32c1e11bcbe87c9e0bc1295eba590cdc176db889efe58d5b9ed59ae202b139963cc2282dfce491481863e1c7b74ceedb88765b82e93721b6bea37f4efa283685bb075b13e5d79e30ea05cc9fb0604cd15c26f51c0a96184d0a86c5306aa720a272ea99a39b9dc484c0dfab95ceaafd333d2fd489288056c8f45dcad68764e6d497eaf2197cc4c415f78d14f65f06699df63ad7bc5cd14d85adede820c7f7381b18669e7552c3207116178fca44e82fc0160886f0567861719f579c1873126c393ec2cea8077dc3f5198f824d9f7583d78e74c8a40dd2961fb9efcbc50eb2a973a172c9754b7daa0a651b249b8e091ab901efdf8b72069ab4274e467d3e68636dcfdf6ff59b4a141f8ba7ce26f4891af14dbef9b6a41eb0aa2a5eace176a05de286ce9f672a95e14a992d638988c8f737a9b552e7ebad5c663309222c3d82c4ae762480a50b0dd255fce9d87ea8ed7191c005000e21f88090a62fa87c733f6145ba592a0b5097bafc00d0a09be22559709c5d473626315681c1a202f4c20acf3bb7e18e36f018b769fa6218112c9b44ccda9ab143e542167b433b66cdfba0eb8cf1920f7b6aaeb0e6dacdc734be5d37a90e71c1bcd795571688d62fb997f14826c9483977ca5aa9f2e52ec6fa8ecb48026709e643aaf7cc1c5196c4c97b0b0790d01c6ea868ac5090b2ed0dc301799dab4b94f7ae421a0a237b4f5131fb584918eb24378eeb2ea5e7444b267726b435207cf894cf2cb600f1c4595f2af2404b2b5d50d73f0f2a6b2651dc7832df66fe43f8141919e19a92ef55dddbbcc8266b3c995c21a643cee529185c356dcaffbe62d6fc28da19fa01d1da477bfdfbaec9b453a120cbe6ae868c61df7e52d5800b78a372e319e0ddf349d1abc2b35d2bbb9642c47b442ac7897ef5b379ca41a0d647a20374777e11cf760d69b102495310ffc425ae972b8382f0811fdb172e487247a3e6ae0a1182ebcb6da00e21ebeeffaa9398256d5aac1a27f6246bee6495348556add1520821239e40aff55e5f659feffd591353087f0dc3a9668d13dfe4a90dcba7d8bb79b631fe7eab0dc5ca3984b601ea1a5a71728b203b0b19962a2b186f2162149e075c90454ee063999982ed73f34ba0ac4ce0ab1a8156a6fea08617d9901604e501a54a15061da186f578eaafb6c19964878b94f80a7a6959c5e2df6d2c68d7a3bcde730c675ec973d63e6d8e3236e1b4243e199d89a86e7087069017734d67d4eaa758a0db0eb0f5033372924732ea1dafd2288c7745254b8c4453654b95ac56f1872dbc8817efa75d165f5c7c22a88f754077cc6fe5e859efcaf4e104d433d08fac143910398c4e569f8e3ca0dde20ea1cc8efc9c1e4be057355f9c07dade5baeb13debda09292df923c0ec66d4d4c17acf8b1e0068c111e994327a7aaead08a52efa510f103488c4bb619a9fdb13436a2a9d1ccc35dfcc1301e28337d396e1efd89913f65ab4a1977251e1b75ae9eef8a15f856405eae264d185448dd99f5b94190cfca146102209a826f7f5febe6d9162360cf203e3242634be7feb8e91bf10475bbc64b20f0bca9153f7c2c262b5c7579dd5e0280b6eea86d7060e6a252fedf6e8c360b0d231ed784a7c76ff45cdaa7d5331905c01776aa6504ccba842b17e6a42f1fd71e780ecb17d4be025d6a03608bd75baa70b792648950cc28987225203ebe02a7f163876089e9c61ce520821af83f7d2ec951660985ec1990c02cb9250831f09132820239f43c36adecf7b72ffeb4c52e34a359887b16b1a74fa9406a01945c88c381f8b60da2762c146f315814dd534c645f5fabcca67bbab12bc862b5d40f18e0a008f3862491936cbf7a88f88bce2101c3f903569543a5804b182ad913c97caa1dca6633e69e006a2b5f2afceba2823c350a4a80fc9baec855936104f08e15e19b1fa1b50e1d68fca7e2d2cb5f20f1f62a804b7bb376f73058f5226277352ef153fa1349dd763f6d8abc1f37d3f8e1c495ad3c82eda371946a12e3c4fc4d4573d3abbf8d39cb7d05154bd559910f8be98d31794d2215be90499ab6d3a4920f09314bbfa725c6aeaa8d0e295f9fa8ac1c7b70384c9839f9540f44f64999197a505218da5cdaa4ded6f781737fcea108030d4b84b8eeb10813e2be795986ac1936b06957e601b5ad569eb98dad3e9c574a0612fb4fd288df24f7393e3734c86f155428218f8babef0faaeb450f9a8e5083a60b591dfdea24d07b86e8d644a27a19b3a4009068b3dde9a7f2c214aa9e1b6b4f2ebb697c72e9b784d55cdb3021452b0d02cda87cbecbccf088109a730e8c9f72da854c0028948d1ac258816a4eab06ef81c0a92ad9c31085a0d3bb573176bfc01e0e754bfe11c2dc0a1c0b1eac0e042465cd7a8c1daca3d6ce5dcac2b4366164d7207a5384ec6ec1be6015d5be36b74503ab56ab2495747ff10827348b34610811b94bde31d3d1c96493d1260f9c09f723466c659efa10cabaaafb16539da66838bc097cb1c357e4c299473ed0fe73076ed65c139922bfa64748ca26ae448c5bd1a815244241454b27dbe7afe68ebad2679be416ef6effa712327db46391c17b5dae0ea81b6c1cc9d0f477ff2bc07d2ef851e4bdc7f01b87aa849c9b73d61d723b1f16410f03862911f4567132629d63063b5edfa88659e8dce9392e7d86a48bb8ce7424366ff694533de4aa8bee2ca76661aadd93955408a3bae34f8b506f00f2d755ecd0590f28af7ae785d4db94892752f4134c693d21060607"], 0x1004)
syz_emit_vhci(&(0x7f0000001040)=@HCI_VENDOR_PKT={0xff, 0x1}, 0x2)
syz_emit_vhci(&(0x7f0000001080)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x1000}, "e99c66c907d332b633a5340fd6326423ae7ea6485bc7715228c6f6d5fab6d8a2ba1c2a57cab98ca581bbf971d22a6c5a5d1aed5d36b876d71a79cddbd2edce5374867b905c030a2b0ab3341e0f437d449d5bcb972fb4e4d955ba89b287f1639e3c50c218082fcec8b2b04096c5dad3da01040a48b5a98787ca2121ccef66a13fb7be33f3c87c69b05e550ee6becd7e9327131e029e92dacdac485a1f14461ae2da62d773a4b7ad8a4fec7aae016410daf079ff85c9a5031300823f09cab90001ebc42485a13f2bc24591ce67fd03ee127de23729f3ccf647dc176288e107d68947d2465de57708ac05528c582c4a9c55a815f40ee1cda4e2f83aa93890b3d98d3e5dacb1d3223da76a90a695d3e07c68aaf4bb12d80bf79884ae3251bc7a09338178415b7fbc2c4872a21a7bc268779703cff2e98d81ff8f50d7671d0646a95e62844e789297c087906658feafa4b633e745ad8a2c66fa2d717619d218200e37ee98711f35d61c1d965f373a76ded62637838e92177b373c9f0ec4d9b884811a23cc2ab98d4105592fdf46630e34b2c81b9f6e1981824ed04c436bfe54be7490c5a5c881935f0d387cbaf0758b300febd75262033422e6a5db34a9419f1decba5f8c14735be7173e3217c44f0c50e311f6423556e73ea231fea37077ed57eccafcb711b4b09857ae15503b98f8d89c29c72c7dd24c121f6e0eaf2f20ed80523f108b64805e50ce97b94e277a919fdc890725e3808d67ab65f95fa4f2ff1001836fb2a35bfb1d1a677e4ec46d37beb14106cfd11af1513d32d5a239d6fd56b80c21c305b99eeeb9900eaea40a72f4b14bb2e2e1b2f51af4dce22728769e0e32a0cf4d0fb55e5f1c2dd3a586f0047d44bcb595e1cde7a62844e38d3531f14e81904261da584ca320b8f8987f960424dede3410296071031920d2fdbb1850dd88264f972fcb1d8bad598480627b42d10212ec913df835773963f3056d7867eece4c3b996b6b3202ea98561cca6e1c72f8eebf6ad5c91ce36fe16054e4b3b6ad909bd02935fed350ee01870d8a2f446bea14de1bb9b0468a6604f66f6f50df13bb778c9e9f218af99c6e5a885d3185fe5b42b810112e256163ce1af957f13392a1c74d2cab84bfb82af1f6c8c6a2f6ed237f66a6db9627f164f67ee0d7a5750d47f8144d2db691f9fe428462fb66209aac612116d1e68743d0b1cab7e734be4c82efa95f94b4d433c25e6d88bdfc571a77dc958a5fe8c156f7a0dc05f6426a0eb0c534f6f0618a13ef9be7fd09f79969e68460344b67da4b32718f5fb686ddad8241628389bbf8328baa862bfc6bbc07106f6cfc215c3117b91fcf9e537b9c5108f1ab5eb172ce5295d0c22a3fe4573e1506cfca2c82e66a3f8aa71af682f39d8c1bbaea23620b223c9ec1a6b7f2e76876ac3a3f43b78022213b45f30bdeeeb9fcb0b9a79d4d1054c3e2bfe7e5fb80effe92caefa2d443709f78a204c9fc4f71b9bacfcd836d153ca096e6de48644217a49709838393c362e92994673fb3f9e2b81f36785b8b2f7f9f7a46ba79cf7e12370f25911f79c9b0670cf2b483e8e772d9bced8596303655da89fff13178d49ad58a148cdf211c8098bcbe127bbc0d599de68e38e65b05dbbd76efa0732e001b4fb6950610e1b2c745c53d21d4064e5275074865eee95693db4020336a287b8ef8352443367fd6ec0f6dd1afa19a79eea7e0bc7cb180bc4e458cc4568e57f9e00dbe868c2b9819f697785df85c3132d8cf5768aa2378260722372227b1faa7d27bc12ce44a956624420f9c7cbf08cf6f8fc5436a0a60432e7ca6bba86e4eb0f1cce842f79fd2c549b8b7e72d604dea4f3b392c365ad4d62e09f6946c72e66e475f7824a497a050841e01eaca91fe11d3b274c13f8156e4b26471361f97841fe4f7963aef28a216968396eab60a58e23989c3adc5b3aa73661fc1954fe608e642b592cdfeb3bb929a23f48257e2650b756123b6c0119fd947718f8484b471aa30d8038d6acf0e4c6ad23c56c646e83b48146304c2bca2dab10ac9283887f5a1fab3961e1a4c752d2645a5f807682875fd7ea294b9f80ab2994b7cf68facf9b4f1cb3c6b1c6473d6b3ef2192bb98f866a9a542b577eeb6ab09917e7666f0f59a185d2f8cb312fdc35878b296d9ae8ea72913de44b5a043c7f1cec93a98e87b0fe0defcc265c63c78fd4d4b440e240a9fb9e27746f36a6d255a197ae22711b78cff560b0458b9413e15b8b0118aef6583fa631a624707a2c28c23e0a7a2bc79678880edb305f6027905edaa6442fd853d1b94b13ed73d38f6da78427ed0b18b47e0cc54b24f99f71b12dec1c65f4c357aa0fc8460506cc9f8323009d3cbbb257caf0d6ba63953d402c37006f6c438ad5462500e7be8f6ff8eece419f7cf96c4fa735739f5243c865342befc7eab216e687ab7a11cb44a83ca07af45962a803cc34b87932e74da158b4b550a8e714cba5252d8597552776a4e932adfc105e99914b5603b48c659a07df1cfcfa04a6d3e480f20a5957a9d68919e9998e50102291da05f38227b347630d75fa079db33616ab7c09b7874e5828bbd8a12a2d2661deaac786904728b8364bdd377733e5944905b57beb627d0df48614ddbd8c2859637ffbc8ffeaddd6ec6059bc05c66aa8ce9f64ec357be653a30f5aba953d290ae760904d7a8ddaa0282ae91606fde1d9cdb821af98a0d246f252409732e3845bb7dd9182129f7f0bc4e17331ad465c9cdf82f23cfaa289037866734a6258d4858924bf88bfea48a0c951182cfcf012778fe843605ffa8ceafec7204534c64b308b11d0d849fd070dd1deefc329c798f8bb1246f3e533f13b45cfddbda8e43e3f6eb2a5565c34460c3d420d080a507ee25e1281964fe0569345288bbf70827400e38fca63fbfe2efca8ed74491a04e2977279b42f3f11a85e7107c54553025d4e75335f42bb7dde7bc367adf1ccd3acbccc690ef2de1f228378df63c49de6334f35ded8ae371c8259437c113e3b486502cc04bde01459ef0a55f95ced55845e2ba6cc8f210291efbdd377e41efb777dc2f6859814bca124bd05c9c2973888195a99b318e1f51434e6385ded51afe1d9ec9b6e0f47b683199b24972f7dbbc90de3155781cd7d4a12a093c731198e92313867427fd36623bdd81e70e54019f818d6f59cbd8e955989feac2cb34cab299992ea8aea26dd40b99680f4df8d0fd579f0c3abf901577a6131678cc03d29ec7f137593b39d14eb943eeafb93ac74f3bcce89839620e883a8bbc76108539a32a96a889f09dc2f30a65bad23e1cdbbb208aecc3af2e7167cc3011336586e3c77cdf27392b8f697d2e48364f6059a022b6d4e08226cb38f33a93a6285dc6dc944ba17c037d92205e0e31b632d05af9e5b6b06ecd1f83007c7a15217cbe3647b18ba74d712d636b840fa1869bc290e3c21e94c7dce0c285bd5696b08d2f139db1e1c52605f3ef4446222296c4d2b9aedc83b4d6c97270f228459f60b8e5325442671dc727a33c74963adc5bffe81c646b79d2898f78fea5140d3e5f30786ec4dfbd1d68f274c462f67a08c50fcb3e6203f7541708c1cfcb65c5c8e8804368cc35c724973c5e8f3b3d07dd9a7dac73295fe71f838351c63775d9c6d800328909c977b4ca6ccf3e62b657ea782f7a63d29d573248c597743d9264e782a8cf70b8554bab3c1132ed81b07b808c0e0f3f1426aa73ca518f9153addef21d561fe1ffa810dbb5099b8bca3d5d6fe52fe355ce04d45ada78a9bc52024ed9c08e7762fa470e2ed7091013751b0262259dd014666d8673fa8365591b496ccbd8017ade5d1e8dea5b58cb0ea478e68d24a6ca79f100e5d5221390d6610d6cb65a58d8b66e342db07422a773b69019eafef686bb8a992521898f1ab46693911814d941d8d4db48a83ae311c4c8b860dd9bfb5aecf7457567b99a809315a645dd8ea3e4e53d80a1c10bf8fc3c38fcfe77115a771f255d13f87910593563dc68111a0e8e455c4c736d93aa80882973525bade65434288b56e70d9545b994fa5641ac436445166b3785dbf6670449492cccf7d0a09f6d10f458e5fca2486427c491f95912e1dedb17e2cc058a60df0df0cda2d791e7313b74f974ef6ba91304c919e5f5b41df8f89a7ce4ca156cb05c6808abfeaa521e1ad1fbf18637817a414b13958b23b3dbe34caead2513ced74991a21b395b1b0114f26d6d82240302de0b8db5816ca70d3da162d9a0a6b0356f3f23e92bb2d19b25e59b7d94a5a8ef30a63a67bd2cce6d16407392b6f38638753418b3d66a259af3700f841aa697821e4e106bcb0ff79ed90a9b6cac89c5d938c9dba2605d93c2c034788a7d68ee647e9b5f30f78ccc618c7adb1f1d4dcecc9db8c311022bf3b0d61efdfd0ca8269d36b1b28c26551914e6a9bfd98159a8b00e031b507782c7480dc04f8d9cc5336a0e11144d3b386dd434348c94438bdd866c055f0ea5cc3b41c5fb9b651eccc2d5b8d3c9cdd5609ab0a9ef3f66432ece606bef4149605986ba4f2be3427b3e53ff1444eab17a6f63a869c50e0d2374b932f6c2d821a4cb38d9865616ff3cb6667bb53caef93b1a5bc412f0a876080dee415f4df1bc99d63babe1987cda835cf9b38348ffb1608eac19aa53bca58da71bc4f192ccd737d2923bf4893af6f8100ecfa5400d1a2eb4c84328decb6750284a0f68ac72b6354400f884ae2daffc83ead245ee23347a17cbc8ef70a99a31f11e7f7d699a55b6b2176587ae036b3ad1b3615eb5cc9d52dbffcff87e59e00ed071defd134caee6134c5e894d63595a156f4ef5eb92be355cbf47eacfcb4789d8fe306886236fc45a5ecae72cae9dee79eeb9ee7e1f6d9deb2988b4338e45e6a7f535271381af220988260690fdd5abfdc2c9b6ac9b85ada56ff2f2d406d9a980889c2ce13cba5219dd739cc2ab0aaf6bd9e1f687bb313386a914f168231c8a9c96736c83de858a224b96390b6498e2b221f30b7833e770b6cf34465e7c46f0ef0d561b8cf4fe5bb3acc7eba64543dd0e215d0f052857fbebae7588a2366009c6e75860475b467549b6dc36964b4d8b542a281bf662f423dc523e9ae688cd55adb95a1169d74fe64cb3f1ad8bed3d40dae04f25b8d05881851f2da6fa41ba5ec10a29967669a3077775f24008037386a553902c0d7e17bddeb1256925ba0fe31fefa717d08ef21bc81f7f7c625948af783c7ccbc8b61afb90bceb44c24ccbeabc468c72b1902298919bffa6b1309bee0c442be7da9fa8043b1d6ecfc66a7e2f53add0ccd1fc120774ee7db24161a29fddea96ae402e77f3bfed11a72857ee958cf246e6559661fe6fc76f0f8cce42e94d714f473550b4e525d2f5857871a8c6b1128ce24dc29440f7711e5f29a0f88543ef229a063e6e6dbe5b158cf9b369b896411820e827cd2233c534cc9ea2731770429d940f409661d00ec8cddf0d535a7a958a760db2fbcb5e8734d616c10b2a4e613ca3101a38dd93665d446a307be45b9ed2e1f28f082a14c114b7e1f039ca6c90af69a3919758cfbb9ed00b6f549cd0b5bc3c9fc4b45cbed635d496d4b793cdf135963b04090ae7900ef026fc8b3acef7bae5661d6dcd12f64399482d879d9e1ea4423f4ee2fd9860937eff923f6c5fea423f348886bb5199a7bc321fc4949ea1a2bc5e90326fc6bcd84c7d89eb7b9d0d531cd1aff3d25289d53e55c645688446e0c406c3334c27f77ba39ed2b5e9de839962c9e473bd6e4bd985824e1da6887ac9397dd26f39b0e964f266024a780de01b"}, 0x1004)

04:38:59 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, &(0x7f0000001100))

04:38:59 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, 0xffffffffffffffff, 0x1000)

04:38:59 executing program 3:
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, 0x0, 0x8090)

04:38:59 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:38:59 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 3:
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:38:59 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, 0x0, 0x8090)

04:38:59 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = socket$phonet_pipe(0x23, 0x5, 0x2)
getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, &(0x7f0000000140)={0xc, 0x3, 0x1, {0x5, 0x20, 0x8, 0xc}})
pkey_mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0xffffffffffffffff)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x1, 0x1, 0x2})
ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000100)={0x7, {0x1, 0xb7, 0x7fff, 0x8}, {0x8, 0x8, 0x7f}, {0x8000, 0xfff}})

04:38:59 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 1:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, &(0x7f0000000400))

04:38:59 executing program 3:
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 2:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800)
getpeername$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @initdev}, &(0x7f00000000c0)=0x10)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYRESOCT=0x0], 0x9d)

04:38:59 executing program 0 (fault-call:1 fault-nth:0):
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:38:59 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, 0x0, 0x8090)

04:38:59 executing program 1:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, &(0x7f0000000400))

04:38:59 executing program 3:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:38:59 executing program 4 (fault-call:1 fault-nth:0):
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:38:59 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_conn_param_update_rsp={{0x13, 0x40, 0x2}, {0x9}}}}, 0xf)

04:38:59 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2)
ioctl$VIDIOC_DBG_S_REGISTER(r1, 0x4038564f, &(0x7f0000000080)={{0x3, @addr=0x4}, 0x8, 0x80000000000000, 0x1f})

04:38:59 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:38:59 executing program 1:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, &(0x7f0000000400))

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0x2, 0x800)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYRES32], 0x20}, 0x1, 0x0, 0x0, 0x20040080}, 0x54004)
ioctl$NS_GET_PARENT(r1, 0xb702, 0x0)
socket$nl_rdma(0x10, 0x3, 0x14)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0xffffffff7fffffff, 0x2480)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000240)={'ip6gre0\x00', <r3=>0x0, 0x2f, 0x1, 0x8, 0x6, 0x28, @private2={0xfc, 0x2, [], 0x1}, @private2, 0x10, 0x700, 0x0, 0x7}})
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r2, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', &(0x7f0000000140)={'syztnl0\x00', r3, 0x2f, 0x80, 0x0, 0x5, 0xa2f1f71aa88bb36e, @mcast2, @empty, 0x20, 0x1, 0xfff, 0x3ff}})

04:39:00 executing program 3:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000080)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_SCODATA_PKT={0x3, {0x0, 0x14}, "c8b6197f7d0a2bb8f4a98eab654b8c13d2859fdc"}, 0x18)

04:39:00 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x4c, r2, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4000000)
mmap$fb(&(0x7f0000ff1000/0x1000)=nil, 0x1000, 0x6, 0x3d5f499abec1707a, r0, 0xa000)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 3:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x0)

04:39:00 executing program 1:
getsockname$l2tp(0xffffffffffffffff, 0x0, &(0x7f0000000400))

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getpeername$l2tp(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000100)=0x10)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
accept4(r1, &(0x7f0000000000)=@nfc_llcp, &(0x7f0000000080)=0x80, 0x80800)

[  830.652615] Bluetooth: hci2 SCO packet for unknown connection handle 0
[  830.666063] Bluetooth: hci2 SCO packet for unknown connection handle 0
04:39:00 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="6766c7442400d20000006766c74424020f9ea81a6766c744240600000000670f011c246766c74424000f0000006766c7442402470000006766c744240600000000670f01142466b9800000c00f326635000800000f300f2171360f320f32b8e8008ed866b98b0800000f320f009f483764f36d", 0x73}], 0x1, 0x50, &(0x7f0000000100)=[@cr4={0x1, 0x500010}, @dstype0={0x6, 0x9}], 0x2)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
getuid()

04:39:00 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x800)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x3000)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 3:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:00 executing program 1:
getsockname$l2tp(0xffffffffffffffff, 0x0, &(0x7f0000000400))

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)

04:39:00 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff7000/0x3000)=nil, 0x3000, 0x0, 0x40010, r0, 0x4b000)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB], 0xa)

04:39:00 executing program 1:
getsockname$l2tp(0xffffffffffffffff, 0x0, &(0x7f0000000400))

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
socket$l2tp(0x2, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001080)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000001180)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x64, r2, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x4}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macvlan0\x00'}, @L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000040}, 0x81)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
recvfrom$l2tp(r3, &(0x7f0000000000)=""/4085, 0xff5, 0x2141, 0x0, 0x0)
bind$l2tp(r0, &(0x7f0000001000)={0x2, 0x0, @loopback}, 0x10)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffc000/0x2000)=nil, 0x2000})

04:39:00 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB], 0xa)

04:39:00 executing program 1:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, 0x0, &(0x7f0000000400))

04:39:00 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
mmap$fb(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x2f000)

04:39:00 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB], 0xa)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYRESHEX=0x0], 0xa)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0)
sendmsg$GTP_CMD_DELPDP(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, 0x0, 0x4, 0x70bd27, 0x25dfdbff, {}, [@GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r0}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_PEER_ADDRESS={0x8, 0x4, @broadcast}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_FLOW={0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x24000091)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
accept$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14)

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2)
ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f0000000040)={0x80, 0x3, 0x33, "3c6db7dd981a2b5129b792fd1193eae88182138517c508386a0263fdcfc92d336d6a7f584e8980a03b5eaa94821d7938d6d12cc0c62bc162a66f2287", 0x2f, "ac4aba106804ff38791a16a859cc416ed2ffd96ec5785c66d92e31b505712427ba7eddc77280dcd9aa54eb31703eb8a0778b4a28766d58c22241cd6e", 0x40})
r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f00000001c0)={0x0, 0x0, 0x0, r0, 0x0, &(0x7f0000000180)={0x9c090c, 0x6fb, [], @string=&(0x7f0000000140)=0xc6}})

04:39:00 executing program 1:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, 0x0, &(0x7f0000000400))

04:39:00 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB], 0xa)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_SCODATA_PKT={0x3, {0xc9}, "3e544bbdbf167bb0005bb9f3ccfc1727f55c1e6af106257206ba5386faf9bbfdb483a56172bf02c61efa23a0120d1a3497380f5b9ac50620fa931ff9841b8af4f2fbbbc8c71e71cd3a6535b90c32c393bf2069362f6cc6e07fad1f70b2847d64cdf75842"}, 0xffffff08)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="04002dbd7000fedbdf2505000000050001003f0000000500060006000000060003000000000014002000fe8000000000000000000000000000bb0c000f00ffffff7f000000000500050000000000050013000700000008000b0003000000"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x80)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 1:
socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(0xffffffffffffffff, 0x0, &(0x7f0000000400))

04:39:00 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = fork()
r2 = syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
r3 = accept4(r2, 0x0, &(0x7f0000000200), 0x80800)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000280)='gtp\x00')
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000340)={&(0x7f0000000240), 0xc, &(0x7f0000000300)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000007e0e8d01940df1cf7806c1a7e44bd8aef73cbbeefe5210f3e80ca9c4ef7fa5e80b4f409ef295bbad1ce8d925e9815988c03ed581970887e6043cf3ec04f7207d7024859052f4f0ad543a58a055b5061a304d9580ec7ae9ca8c18e8e98b62a2d3f16bb601d42d89ad919b", @ANYRES16=r4, @ANYBLOB="200026bd7000fddbdf250100000008000100", @ANYRES32=0x0, @ANYBLOB="08000500ac1e01010800020000000000"], 0x2c}}, 0x0)
sendmsg$GTP_CMD_GETPDP(r3, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x43434378e8f94742}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x0, 0x34fb961316719945, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x35208b1cfa2c5142}, 0x1)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032dbd7000fddbdf25310000080000db00", @ANYRES32, @ANYBLOB="080001005d000000c7d59900001ccfb5fe5d297047607d8af954dc"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008000)
accept4(r3, 0x0, &(0x7f00000005c0), 0x800)
r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r5, 0xb703, 0x0)
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, r4, 0x300, 0x70bd27, 0x25dfdbfd, {}, [@GTPA_TID={0xc}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r5}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010101}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}]}, 0x54}, 0x1, 0x0, 0x0, 0x24004010}, 0x804)

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0x6, 0xfffffffd)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00')
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fedbdf250d0000000500300001000000080034008100000005003000375d2f02"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20040080)
socket$inet(0x2, 0x3, 0x2)

04:39:00 executing program 3:
syz_emit_vhci(0x0, 0xa)

04:39:00 executing program 2:
perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:00 executing program 3:
syz_emit_vhci(0x0, 0xa)

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080025bd7000fcdbdf2501000000050012000200000006000e00070000000c0010006900000000000000080019000a01010206001d00000000000c001000060000000000000008000c00020000000800100000000000140008006d6163766c616e3000000900000000006d7c9abe057f94b1fa54e9033d8b6f094a775f5be570df8b88b9437d0126892907228a4a05433c550e325a421baced821744ad283982bb02907e69e6b3fe8385aa364ed729e6de2484d73ade1c645becd1458cbed70ee5e8ef83f0e8a10141ecba7d4a1b8e26b02760003c563117a612ebd50045210b91646ad27247227ed4d52d692a13"], 0x70}, 0x1, 0x0, 0x0, 0xc001}, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socket$inet(0x2, 0x6, 0x80000001)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 1:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:00 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
bind$l2tp(r4, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, <r5=>r0})
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000280)={0x6, 0x0, 0x3, 0x800, r5})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000000040)="ed320b5e6f19e059094599d0b0315d51c3dd8b23a1d1a25867cf4da50e6d4833b2f503d7a68405cc67449e4a3ce38c3dd39d1529bb94f8cc2b8a5378b934e31a0eebb85c33d5a2de54049cda0c9a98fb239da0e0d014b141354a1a398a737bf2d6046551cf078cc6bd9389a924004b250b363c778aa5a4781f021462df381e18167d225b629a5d49703d1fe8e893e0070c8571fc5afa9f201ed1cc6734d30baf9ddf5a5a9f959bb254bedbf0218f3ff5284b0909f9b5dc", 0xb7, r2}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x100000e, 0x40010, r0, 0x1c000)

04:39:00 executing program 2:
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x8, 0x0, 0x8, 0x64, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7, 0x7800, 0x9, 0xbc}})
syz_emit_vhci(&(0x7f0000000100)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x7b}, "b8ad95066efa3ae48d710ab376398f047388fcff63484946a603ab7a0ac1c3297dc9e89f2a719111d81f6120551016c23ab86e194868e9cf6633a6578710ea73df28f091c8e6ea08a12d0b12a852c47be893e0235eb8421833f59339e5e1fcb77ddb7deda9faec69e0a48cd6700c75ebc7e42b173e7309dc078ed3"}, 0x7f)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fb0\x00', 0x200400, 0x0)

04:39:00 executing program 3:
syz_emit_vhci(0x0, 0xa)

04:39:00 executing program 1:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'sit0\x00', <r1=>0x0, 0x4, 0x6, 0x5, 0x3, 0x10, @local, @loopback, 0x80, 0x20, 0x700, 0x10001}})
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'syztnl0\x00', r1, 0x2f, 0x9, 0x80, 0x1, 0x15, @local, @remote, 0x80, 0x8000, 0x5, 0x8}})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r3 = accept4(r2, &(0x7f0000000480)=@ethernet={0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x20040040)
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000000)={@dev, @private}, &(0x7f0000000040)=0xc)
socket$inet(0x2, 0x2, 0x7)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000)
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000200)=@nl, 0x80, &(0x7f0000000400)=[{&(0x7f0000000280)=""/145, 0x91}, {&(0x7f0000000340)=""/118, 0x76}, {&(0x7f00000003c0)=""/42, 0x2a}], 0x3, &(0x7f0000000440)=""/59, 0x3b}, 0x100)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x1, 0x7f, 0x7, 0xc, @local, @mcast1, 0x80, 0x7800, 0x18957703, 0xbf}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000280)={'syztnl0\x00', r1, 0x29, 0xd6, 0x1, 0x1000, 0x13, @local, @mcast2, 0x8000, 0x10, 0x80000001, 0x2}})
syz_emit_vhci(&(0x7f0000000440)=ANY=[@ANYBLOB="02c84031012d01010005062a0000080500050005010004090140890400810002000610fb00020003000000030000000200000002021d000c010500ff7f008000040924000000040005010104090204000001020001fe0610060200500700000003000000e0ffffff0440160006000400061002010500020000003f000000030000000f030400010405000b07d40001f808007d4c07dca4abcd752475e101ca53c9f6c9a2de2e1a481fdb32041b2e1d7f34ca31134d05be54e7985070c8ac79217cb957abda338aca2521c0b6519e434ac817d4adeeac78db702a55f53ae5a6dd0355d4aa6c0d65269413193ec17115d7cdbef114b96d388041247666937ae5e42bb7661ca4961643f39512df3d5efa30e4a1802f0082d9e520f35b1ffa6a76071a2c15b1c41e0a079435274015099d8ca6cc960ed1fef6fed5f7ea088cd2f012dcc24261dd73fa9e"], 0x136)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x40, r3, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x4000010)
syz_emit_vhci(&(0x7f0000000040)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x17}, "812d454293da78781ea4cc2a6c97cc8cf45d859f7e25e7"}, 0x1b)

04:39:00 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x64, r3, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @rand_addr=0x64010102}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[], [], @loopback}}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x8001}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_batadv\x00'}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x3b}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000094}, 0x4040800)
r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r4, 0x40305652, &(0x7f0000000680))
sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYRESOCT=r0, @ANYRESDEC=0x0, @ANYBLOB="000125bd7000fedbdf250200001d080005000000000008000800030000000800080003000000080002000000000008000100", @ANYBLOB="f6bb39e3c7903444f67c7d75cbff707e3ea72aff05d32bd4f6a03a10f4f6bc15c247efdd945fb220212fb396bfeba6ed5c4dc81819c163c2e134127f2f7592078b6dd1355de1d1", @ANYBLOB="0800090002000000080002000000000008000700", @ANYRES32=r1, @ANYRESDEC, @ANYRES32, @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0)
r5 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r5, 0x0)
r6 = syz_open_dev$vcsa(&(0x7f0000000540)='/dev/vcsa#\x00', 0x6, 0x0)
r7 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00')
r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/shm\x00', 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r5, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'sit0\x00', <r10=>0x0, 0x29, 0x80, 0x2, 0xffffffff, 0x2b, @rand_addr=' \x01\x00', @mcast1, 0x7800, 0x700, 0x5, 0x1f}})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r9, 0x89f9, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000340)={'ip6_vti0\x00', r10, 0x29, 0x8, 0x2, 0x1, 0x58, @loopback, @private2, 0x8000, 0x40, 0x1f, 0x5}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r7, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="24200002", @ANYRES16=r8, @ANYRES16=r8, @ANYRESOCT, @ANYBLOB], 0x24}}, 0x20004040)
sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000400)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000128bd70002000fe880000deffffffffffffff00000100"/34], 0x30}, 0x1, 0x0, 0x0, 0x40d0}, 0x200000c0)

04:39:00 executing program 3:
syz_emit_vhci(&(0x7f0000000000)=ANY=[], 0xa)

04:39:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:00 executing program 1:
r0 = socket$l2tp(0x2, 0x2, 0x73)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:00 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
set_robust_list(&(0x7f00000000c0)={&(0x7f0000000080)={&(0x7f0000000040)}, 0x401}, 0x18)

04:39:01 executing program 0:
getuid()
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="7c000000710000022b000000e1f710b1b070f66c260000000003000000", @ANYRES32=0x0, @ANYBLOB="0c0001800800010002000000100001800c00048008000100020000000c0001800800010004000100100001800c00048008000200130000000c0001800800010008000200100001800c0004800800020011000000100001800c0004800800020011000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4004811}, 0x800)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x200000d, 0x11, r1, 0x0)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
bind$l2tp(r4, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, <r5=>r0})
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000280)={0x6, 0x0, 0x3, 0x800, r5})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000000040)="ed320b5e6f19e059094599d0b0315d51c3dd8b23a1d1a25867cf4da50e6d4833b2f503d7a68405cc67449e4a3ce38c3dd39d1529bb94f8cc2b8a5378b934e31a0eebb85c33d5a2de54049cda0c9a98fb239da0e0d014b141354a1a398a737bf2d6046551cf078cc6bd9389a924004b250b363c778aa5a4781f021462df381e18167d225b629a5d49703d1fe8e893e0070c8571fc5afa9f201ed1cc6734d30baf9ddf5a5a9f959bb254bedbf0218f3ff5284b0909f9b5dc", 0xb7, r2}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x100000e, 0x40010, r0, 0x1c000)

04:39:01 executing program 1:
r0 = socket$inet(0x2, 0x6, 0xfffffffd)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00')
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fedbdf250d0000000500300001000000080034008100000005003000375d2f02"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20040080)
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 2:
r0 = semget$private(0x0, 0x1, 0x318)
semctl$GETVAL(r0, 0x0, 0xc, &(0x7f0000000200)=""/75)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
semget(0x2, 0x4, 0x60)
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @multicast1}, &(0x7f00000001c0)=0x10)
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_sniff_subrate={{0x2e, 0xb}, {0xf1, 0xc9, 0x1, 0x6, 0x1}}}, 0xe)
semctl$SEM_STAT_ANY(r0, 0x3, 0x14, &(0x7f0000000280)=""/166)
syz_emit_vhci(&(0x7f0000000080)=@HCI_SCODATA_PKT={0x3, {0xc9, 0xf3}, "8d78697bd90123bf4fc250809222c7bdf64b040a9fad16a2172ea6543a48c8b6f27f27f6c724a99698505b0f2c3abb2ad13aa88286b27b6826d1ee6c1b1812070ceb1807a446169d4e2f762ce1ef736710bd30c5dd41e785a5b1825198424452d57c4f783a25026bbd9cde59e80d3838089deee7668d81d54e1821bd412000709dfd602e962d409fe03a4bd8a26f0776938704ab8e3f045f215e72ff3f6f45b36f15a7630c80d620551e20992a2702b50ffd75eebcd07e828bdbb695f126355945e6e2c56e385f4d7a3277ac00d8a6f5e86b47308e051f954849699de5c06082c0fff1cc151198c13d933ba76aae7669ebbfeb"}, 0xf7)

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 4:
socket$inet(0x2, 0xa, 0x0)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
bind$l2tp(r4, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, <r5=>r0})
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000280)={0x6, 0x0, 0x3, 0x800, r5})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000000040)="ed320b5e6f19e059094599d0b0315d51c3dd8b23a1d1a25867cf4da50e6d4833b2f503d7a68405cc67449e4a3ce38c3dd39d1529bb94f8cc2b8a5378b934e31a0eebb85c33d5a2de54049cda0c9a98fb239da0e0d014b141354a1a398a737bf2d6046551cf078cc6bd9389a924004b250b363c778aa5a4781f021462df381e18167d225b629a5d49703d1fe8e893e0070c8571fc5afa9f201ed1cc6734d30baf9ddf5a5a9f959bb254bedbf0218f3ff5284b0909f9b5dc", 0xb7, r2}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x100000e, 0x40010, r0, 0x1c000)

04:39:01 executing program 1:
r0 = socket$inet(0x2, 0x6, 0xfffffffd)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00')
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fedbdf250d0000000500300001000000080034008100000005003000375d2f02"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20040080)
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x1, 0x204100)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x3000)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_ENUM_DV_TIMINGS(r1, 0xc0945662, &(0x7f0000000040)={0x3ff, 0x0, [], {0x0, @reserved}})

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 1:
r0 = socket$inet(0x2, 0x6, 0xfffffffd)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00')
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fedbdf250d0000000500300001000000080034008100000005003000375d2f02"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20040080)
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0xa, 0x40010, r0, 0x1000)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'})

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
bind$l2tp(r4, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, <r5=>r0})
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000280)={0x6, 0x0, 0x3, 0x800, r5})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000000040)="ed320b5e6f19e059094599d0b0315d51c3dd8b23a1d1a25867cf4da50e6d4833b2f503d7a68405cc67449e4a3ce38c3dd39d1529bb94f8cc2b8a5378b934e31a0eebb85c33d5a2de54049cda0c9a98fb239da0e0d014b141354a1a398a737bf2d6046551cf078cc6bd9389a924004b250b363c778aa5a4781f021462df381e18167d225b629a5d49703d1fe8e893e0070c8571fc5afa9f201ed1cc6734d30baf9ddf5a5a9f959bb254bedbf0218f3ff5284b0909f9b5dc", 0xb7, r2}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x100000e, 0x40010, r0, 0x1c000)

04:39:01 executing program 2:
r0 = fork()
ptrace$setsig(0x4203, r0, 0xffffffffffffff9c, &(0x7f0000000040)={0xe, 0x9, 0x18})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000100)={@remote, @multicast2, <r2=>0x0}, &(0x7f0000000140)=0xc)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240)='nl80211\x00')
r5 = syz_open_dev$vcsa(&(0x7f0000000280)='/dev/vcsa#\x00', 0x10001, 0x4000)
r6 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0)
r7 = fork()
syz_open_procfs$namespace(r7, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', <r8=>0x0})
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x68, r4, 0x400, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x27}, @val={0x8}, @void}}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x13}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x4a}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r5}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r6}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2b}, @NL80211_ATTR_PID={0x8, 0x52, r7}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3, 0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x400c000}, 0x88c1)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000180)={'sit0\x00', r2, 0x2f, 0x7f, 0x1f, 0x9, 0x0, @ipv4={[], [], @multicast2}, @ipv4={[], [], @multicast2}, 0x20}})
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
bind$l2tp(r4, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, <r5=>r0})
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000280)={0x6, 0x0, 0x3, 0x800, r5})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000000040)="ed320b5e6f19e059094599d0b0315d51c3dd8b23a1d1a25867cf4da50e6d4833b2f503d7a68405cc67449e4a3ce38c3dd39d1529bb94f8cc2b8a5378b934e31a0eebb85c33d5a2de54049cda0c9a98fb239da0e0d014b141354a1a398a737bf2d6046551cf078cc6bd9389a924004b250b363c778aa5a4781f021462df381e18167d225b629a5d49703d1fe8e893e0070c8571fc5afa9f201ed1cc6734d30baf9ddf5a5a9f959bb254bedbf0218f3ff5284b0909f9b5dc", 0xb7, r2}, 0x68)

04:39:01 executing program 1:
r0 = socket$inet(0x2, 0x6, 0xfffffffd)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00')
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0xffffffff, 0x6800)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="04002abd7000fddbdf251000000008003c000200000005003701000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000050}, 0x8810)
ioctl$VIDIOC_G_EDID(r0, 0xc0285628, &(0x7f0000000180)={0x0, 0x1, 0x1, [], &(0x7f0000000100)=0x9})
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:01 executing program 1:
r0 = socket$inet(0x2, 0x6, 0xfffffffd)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xfffffffffffffe6f, 0x0)
mmap$fb(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x0)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
bind$l2tp(r3, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, <r4=>r0})
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000280)={0x6, 0x0, 0x3, 0x800, r4})

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 1:
socket$inet(0x2, 0x6, 0xfffffffd)
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 4:
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x2})
syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x80, 0x400)
socket$inet(0x2, 0xa, 0x0)
madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xc)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = socket$inet(0x2, 0x2, 0x7fffffff)
getsockopt$inet_mreqn(r2, 0x0, 0x0, 0x0, 0x0)

04:39:01 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_JPEGCOMP(r1, 0x808c563d, &(0x7f0000000140))
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, 0x0, 0x202, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6, 0x6, 0x4}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:01 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
ioctl$NS_GET_NSTYPE(r0, 0xb703, 0x0)
socketpair(0x21, 0x2, 0xfffffff7, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xc6997ccff0b16e4a}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x1407, 0x800, 0x6, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x4000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
bind$l2tp(r3, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000240)={0x2, 0x3, 0xfffffffd, 0x84000, r0})

04:39:01 executing program 1:
socket$inet(0x2, 0x3, 0x2)

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x2, 0x484080)
inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x20000f8)
semget(0x0, 0x4, 0x84)
ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f00000000c0)={0x1, {0x8, 0x8, 0x4, 0x80000000}, {0x3, 0x7643, 0x1, 0x100}, {0x5}})

04:39:01 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000000c0)={0xa20000, 0x400, 0x3, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x9909da, 0xfff, [], @ptr=0x80000000}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x13, r0, 0x3000)

04:39:01 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r3, 0x40305652, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x2})
ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000140)={0x9d0000, 0x2, 0x400, r3, 0x0, &(0x7f0000000100)={0xa00901, 0xc45, [], @value64=0x2}})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x44804)
recvfrom$l2tp(r1, &(0x7f0000000040)=""/88, 0x58, 0x40, &(0x7f00000002c0)={0x2, 0x0, @private}, 0x10)
r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r5, 0xb703, 0x0)
ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000180))
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_DELETE(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8004068}, 0xc, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="246e1e29", @ANYRES16=r6, @ANYBLOB="200025bd700059c5df2502000000050013000600000006000e00020000007e879a4e4500925f6364081ffde469a53e67a59bebc94b099e47da4257461f578f23a636e695976e7f10e49c152143e8a9e232ded27d22ec220000000000000000c027f3ddac0f0956651ae249b2c1ceb413738692e172a84ac9a664d182bcd22f3bf7cf770d78142909f1458b87e98bad7ed3a247e2f4dd6843c61e8b330fdce8262bba1c7539b3154d3d32b3f24eed08078750c4b9f7a22fcbd1fdad20c7b3887ea933ac4616bbec9a059d2b117314b21a1ddb064ecbf69ac8b90a6258575e8157e9799eb8e9c6e6a0fb4633ce776bdea3a7b8536ff0948e20d0c96039"], 0x24}, 0x1, 0x0, 0x0, 0x4000044}, 0x4000080)
r7 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x404c840)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}, &(0x7f0000000200)=0x10)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x24000008)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
bind$l2tp(r3, &(0x7f0000000300)={0x2, 0x0, @local}, 0x10)

04:39:01 executing program 1:
socket$inet(0x2, 0x0, 0x2)

04:39:01 executing program 2:
clock_getres(0x7, &(0x7f0000000040))
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000080)={0x5, 0xb, 0x4, 0x1, 0x5, {}, {0x0, 0x0, 0x80, 0x5, 0xf9, 0x2, "85f69b19"}, 0x7fffffff, 0x2, @userptr=0x1, 0x724, 0x0, <r1=>0xffffffffffffffff})
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000100)={0x80000000, 0x3, 0x4, 0x400, 0x0, {0x0, 0x2710}, {0x3, 0x0, 0x40, 0x2, 0x4, 0x7, "d4940c07"}, 0x3, 0x4, @userptr=0x10001, 0x4, 0x0, r1})
getuid()

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 0:
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'ip6tnl0\x00', <r0=>0x0, 0x2f, 0x5, 0x4, 0x200, 0x1e, @dev={0xfe, 0x80, [], 0x16}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x936f73dd4e972875, 0x700, 0x2b9cd2bb, 0x5}})
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0)
sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="585b11c4", @ANYRES16=0x0, @ANYBLOB="01002bbd7000fbdbdf250100000008000100", @ANYRES32=r0, @ANYBLOB="08000900000000000c0003000000000000000000080009000300000008000400ac1414bb08000700", @ANYRES32=r1, @ANYBLOB="08000200010000000600060002000000"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x15)
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r2, 0x0)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000200)={0x8, 0x3, @value=0x100})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:01 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000080)="d760001bc827ce861573c142936ef814b6b88ad271d94ec562f697f2a88fa502255530f9859eb45ccd58d91a75bee033aa41184da91f9fee67e447bb002a9f48c5ce6a4f1213ca47d4190b4bc6caa45542ac02f2be134ec154d925d8c94be2fc9c042e4615020b51c1f7b54068f62b5ca6c092aa14e4d9c4926df7dbc0627deb316872aa81e32ebcd05ee4b2db3688df06f32f7115901f3db13d76aedfffaa113f4e8ee2e1e795fab6f05e34311e93a74b463e2c97de6996201112c279eca045e3ddd6cd1d709d0dee7989463aeb53d3852a95a3845a90edcc5a906471be7c25b6", 0xe1, 0x0)
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:01 executing program 1:
socket$inet(0x2, 0x0, 0x2)

04:39:01 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video0\x00', 0x2, 0x0)
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000040))

04:39:02 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x10, r0, 0xcd000)

04:39:02 executing program 4:
syslog(0x1, &(0x7f0000000040)=""/50, 0x32)
socket$inet(0x2, 0x80000, 0xf6)
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="400007b50080f2e517add2753e74db6cbd98e4e536569d26254f82", @ANYRES16=r0, @ANYBLOB="00042dbd7000fbdbdf250300000006001a004e23000005002200010000000c000f00000800000000000005001300030000000500060003000000"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x20, 0x0, 0x0)
socket$inet_smc(0x2b, 0x1, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000280)={&(0x7f00000000c0), 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="080028bd70f044dbdf25010000000200000000000000"], 0x1c}}, 0x400400c)

04:39:02 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4)
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_conn_param_update_rsp={{0x13, 0x7f, 0x2}, {0x6}}}}, 0xf)
socket$inet_smc(0x2b, 0x1, 0x0)

04:39:02 executing program 1:
socket$inet(0x2, 0x0, 0x2)

04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x0, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 0:
ioctl$VIDIOC_ENUMSTD(0xffffffffffffffff, 0xc0485619, &(0x7f0000000040)={0x7f, 0x3800610, "5e03380c641f7bc4a87763a99b3ad516015f2e8297313ca5", {0x6f5}, 0x1})
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:02 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000003c0)={0x9d0000, 0x2, 0x3, r1, 0x0, &(0x7f0000000380)={0x9909d3, 0x4, [], @p_u8=&(0x7f0000000340)=0xff}})
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0x159, 0x0, 0x1, 0x32}, @l2cap_cid_signaling={{0x2e}, [@l2cap_info_req={{0xa, 0x10, 0x2}, {0x2}}, @l2cap_disconn_req={{0x6, 0x6, 0x4}, {0x2, 0xbdde}}, @l2cap_conn_rsp={{0x3, 0x40, 0x8}, {0x0, 0x6, 0x3ff, 0x4}}, @l2cap_disconn_req={{0x6, 0x1, 0x4}, {0x1, 0x2}}, @l2cap_create_chan_rsp={{0xd, 0xdb, 0x8}, {0x81, 0x1, 0xcae, 0x1}}]}}, 0x37)

04:39:02 executing program 1:
socket$inet(0x2, 0x3, 0x0)

04:39:02 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
socket$can_bcm(0x1d, 0x2, 0x2)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x1010, r0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff9000/0x1000)=nil, 0x1000, 0x2, 0x11, r2, 0xce000)
openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/stat\x00', 0x0, 0x0)
shmget(0x0, 0x4000, 0x8, &(0x7f0000ff6000/0x4000)=nil)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, 0x0, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x81}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xde}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x6}]}, 0x70}, 0x1, 0x0, 0x0, 0x4040001}, 0x4840)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/vmallocinfo\x00', 0x0, 0x0)
r4 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x0, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000300)={0x3a0000, 0x0, 0x3f, r4, 0x0, &(0x7f00000002c0)={0x980921, 0x100, [], @p_u8=&(0x7f0000000280)=0x6}})
r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r5, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, &(0x7f0000000180)={0x0, {0x7f, 0x1}})

04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 4:
ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000040)={0x9, 0x3f, @name="1054d8928693cf02a48e8361849897feb1c21d4114efa13ff001995a10989b46"})
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_SUBDEV_G_FMT(r0, 0xc0585604, &(0x7f0000000240)={0x1, 0x0, {0x1000, 0x1, 0x100f, 0x4, 0xb, 0x0, 0x2, 0x2}})
r1 = socket$inet(0x2, 0xa, 0x80000003)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00'})
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x40, 0x8, 0x4, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x4, 0x4, @perf_bp={&(0x7f0000000080)}, 0xc800, 0x5, 0x4, 0x3, 0xfffffffffffff001, 0x5, 0x2}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x9)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xfffffffa}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000)

04:39:02 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4008000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, 0x0, 0x800, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044000}, 0x800)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

[  832.866640] Bluetooth: hci2 ACL packet for unknown connection handle 345
[  832.875653] Bluetooth: hci2 ACL packet for unknown connection handle 345
04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 0:
ioctl$VIDIOC_S_MODULATOR(0xffffffffffffffff, 0x40445637, &(0x7f0000000040)={0x6, "6381c24687012cb7b80134f1a7beca2be563dfb3e80284fcbc4ef04ce5d3b463", 0x80, 0x6, 0x3ff, 0x2, 0x2})
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)

04:39:02 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0)
ustat(0x0, &(0x7f0000000100))
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000080)={0x7, 0x5, 0x4, 0x40, 0xf4b, {0x0, 0xea60}, {0x1, 0x2, 0x62, 0x6, 0x80, 0x6, "836581fa"}, 0xffffffff, 0x3, @fd, 0x5})

04:39:02 executing program 1:
socket$inet(0x2, 0x3, 0x0)

04:39:02 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x103400)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:02 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfe39, 0x50840)
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 2:
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="654d337cd3cf486ebdbfe504b7274537d308d7b7764ae4a7c0211cd03096537d83cfb18db38c2e44530e5c08c2e0b6e561c4c4f45a1f74386de29c78e4e9f26f1da42a89d9e5f8e8384e9f4aa19d4150d742cef322ce5fb73e3654cff53bdd5212bac6ef5a86bd7ebafe3818e8648b53fe9321a19c62191d6f7cb7b63243ef1df22a874b0fe8d17423f2855bdf48dadb6223ac51ef516df9c6c7bd7baf193ad1f0c18ec945592cd0adfa333619d9cc3d253fe898b908e7d96a329ff14d37b68c82275c9ce176bb7cc7825616f535011fa6dbb3ea82c91767f9b751f8f097113fafa1b345594c14cda71d22d0cd096e1cb90afb7d63"], 0x9)

04:39:02 executing program 4:
r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@caif=@util, &(0x7f0000000080)=0x80, 0x0)
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/ipc\x00')
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xb0, 0x0, 0x20, 0x70bd25, 0x25dfdbfd, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r1}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x3}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x10}, 0x840)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
sendmsg$BATADV_CMD_SET_VLAN(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x54, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x37}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}}, 0x240080d0)
r3 = socket$inet(0x2, 0xa, 0x0)
socket$l2tp6(0xa, 0x2, 0x73)
getsockopt$inet_mreqn(r3, 0x0, 0x0, 0x0, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f00000003c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}, &(0x7f0000000400)=0x10)

04:39:02 executing program 1:
socket$inet(0x2, 0x3, 0x0)

04:39:02 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$usbmon(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000c, 0x10010, r0, 0x5)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:02 executing program 3:
socketpair(0x1e, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8, 0x800)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @rand_addr=' \x01\x00'}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x20004051)
syz_emit_vhci(&(0x7f0000000340)=@HCI_EVENT_PKT={0x4, @hci_ev_si_device={{}, {0x100}}}, 0xffffffffffffffef)

04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 4:
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffb000/0x2000)=nil, 0x2000})
r0 = socket$inet(0x2, 0x3, 0x7)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:02 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00022abd7000fbdbdf250500000008000c000400040008001800ffffffff0500050000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4008891}, 0x44081)
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video2\x00', 0x2, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:02 executing program 3:
socketpair(0x0, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
socket$inet(0x2, 0x8000e, 0x0)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000040)={0x0, 0x2e, 0x0, {0x1, @sliced}})
ptrace$getenv(0x4201, 0x0, 0x7, &(0x7f0000000040))

04:39:02 executing program 1:
socket$inet(0x2, 0x3, 0x0)

04:39:02 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000000)={0xffffffba, 0x0, 0x2004, 0x3f800000, 0xffffffff, 0xab2, 0x100, 0x1})
socket$inet(0x2, 0x4, 0x404)

04:39:02 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x900)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_TRY_ENCODER_CMD(r1, 0xc028564e, &(0x7f0000000080)={0x0, 0x0, [0x6, 0x7, 0x81, 0x6, 0xffff, 0x2, 0x5, 0x6]})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f0000000040)={{0x7}, 0x8, 0x3, 0x7})

04:39:02 executing program 2:
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', <r0=>0x0, 0x4, 0x1, 0x3, 0x101, 0x2, @dev={0xfe, 0x80, [], 0x13}, @local, 0x10, 0x7800, 0x3, 0x188f}})
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000100)={'syztnl2\x00', r0, 0x2f, 0x2, 0x6, 0x4, 0x16, @loopback, @loopback, 0x20, 0xff57, 0x2, 0xeca}})
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:02 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)

04:39:02 executing program 4:
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000000)={0x2, 0x1, 0x7, {0x200, 0x100, 0x6, 0x8001}})
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:02 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)

04:39:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008084}, 0x8090)

04:39:02 executing program 3:
socketpair(0x0, 0x4, 0x401, &(0x7f00000002c0))

04:39:02 executing program 1:
socket$inet(0x2, 0x3, 0x0)

04:39:03 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000040)={0x4, {0x5, 0x0, 0x1, 0xaee8}, {0xfd, 0xe876, 0x3, 0xfff}, {0x100, 0x3ff}})

04:39:03 executing program 3:
socketpair(0x0, 0x4, 0x401, &(0x7f00000002c0))

04:39:03 executing program 4:
ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f0000000080)={0x10000, "24192c5d0a994025d5bf72b354ee9659d9a91f965e578441b71b91caa094c0a2", 0x3, 0x1, 0x3, 0x9, 0x10, 0x3, 0x8, 0x9})
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
move_pages(0xffffffffffffffff, 0x6, &(0x7f0000000000)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil], 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], 0x6)

04:39:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x8090)

04:39:03 executing program 1:
socket$inet(0x2, 0x3, 0x0)

04:39:03 executing program 3:
socketpair(0x1e, 0x0, 0x401, &(0x7f00000002c0))

04:39:03 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00')
socket$inet(0x2, 0x1, 0x2)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, r2, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x40}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x7fffffff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x2c000000)
socket$inet_tcp(0x2, 0x1, 0x0)
sendto$l2tp(r1, &(0x7f0000000180)="bf3e55da0887e42c02", 0x9, 0x4000010, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10)

04:39:03 executing program 2:
keyctl$dh_compute(0x17, &(0x7f0000000080), &(0x7f0000000300)=""/71, 0x47, 0x0)
add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="1510144abdf1d977ecd1e7b8545c08d91fc4887067aa7722f29b483bac122393f195ed7a593538f3fbfc1f1b8a6aac6a33dd213deba9dccf013930a1b90f34fa3fe2df99154d551330cf8e1de42f70e19db1e6389616ddc8ca25d65ee2be6f6b9bef2faa47650df3e1af01f5bec814384ac5abe26cdc19427a05ba76f1d2a4f575a2e8dabdf293559a58e43375d8d53a5d4da73cf4f5d2cff26a4ace8d17903b0155e7b4c52c4d6a7f838bc31131f46fead269307c2ea1d20818c8294232894a3ab4", 0xc2, 0xfffffffffffffffe)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_ADD_TO_RESOLV_LIST={{}, 0x4e}}}, 0x7)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f00000000c0)=0x10001)

04:39:03 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r1, 0x0)
r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x22020, 0x0)
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000140)=0xe34)
mmap$fb(&(0x7f0000ff4000/0x2000)=nil, 0x2000, 0x200000f, 0x30, r2, 0x91000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000000180)={&(0x7f0000ffb000/0x2000)=nil, 0x2000})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00'})

04:39:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x0)

04:39:03 executing program 3:
socketpair(0x1e, 0x0, 0x0, &(0x7f00000002c0))

04:39:03 executing program 1:
socket$inet(0x2, 0x0, 0x0)

04:39:03 executing program 2:
r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@phonet, &(0x7f00000000c0)=0x80, 0x800)
recvfrom$l2tp(r0, &(0x7f0000000100)=""/174, 0xae, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:03 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'ip6tnl0\x00'}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x800)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x8090)

04:39:03 executing program 3:
socketpair(0x1e, 0x0, 0x0, &(0x7f00000002c0))

04:39:03 executing program 4:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 2:
syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x1, 0x4}}, 0x9)
syz_emit_vhci(&(0x7f0000000040)=@HCI_SCODATA_PKT={0x3, {0xc9, 0xb7}, "1e30a5e9c40d5d697ec65891daa47e01f45f7b38d276697163433c0d61b288146a67c537ac11b96786fb85d35e0703468d19aa1118c0ece7635466a203ad97bf65caed8b47f17587561ecaafe483278d0a41c1ed9c164762528070156c6fca5371c344e1244685aa046f5731bddf07124201228375423fc63c22d42aa481bd4e9be91186a425371b8b1633d62855aa5a2275636094749ab1c63b1619929069fa0eae226e15b0bb834d76277b9a9537169d1445e6b1ee56"}, 0xbb)

04:39:03 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00')
socket$inet(0x2, 0x1, 0x2)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, r2, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x40}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x7fffffff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x2c000000)
socket$inet_tcp(0x2, 0x1, 0x0)
sendto$l2tp(r1, &(0x7f0000000180)="bf3e55da0887e42c02", 0x9, 0x4000010, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10)

04:39:03 executing program 0:
msgget(0x1, 0x400)
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285629, &(0x7f00000000c0)={0x0, 0x604f, 0x2, [], &(0x7f0000000080)=0x8})

04:39:03 executing program 1:
socket$inet(0x2, 0x0, 0x0)

04:39:03 executing program 2:
ioctl$VIDIOC_QUERY_DV_TIMINGS(0xffffffffffffffff, 0x80845663, &(0x7f0000000040))
socket$inet6(0xa, 0x1, 0x6)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4000)

04:39:03 executing program 3:
socketpair(0x1e, 0x0, 0x0, &(0x7f00000002c0))

04:39:03 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', <r2=>0x0})
ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x2f, 0x2, 0x0, 0x10d934fd, 0x10, @ipv4={[], [], @multicast1}, @local, 0x7, 0x7800, 0x5, 0x5}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:03 executing program 3:
socketpair(0x1e, 0x0, 0x401, 0x0)

04:39:03 executing program 4:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000040)=0x4)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip6tnl0\x00', r2, 0x29, 0x3f, 0x1f, 0x80000001, 0x50, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @remote, 0x7, 0x10, 0x9, 0x1000}})

04:39:03 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT, 0x2)

04:39:03 executing program 5:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 3:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 2:
r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000080)={0x7, 0x103, 0x1, {0x7, 0x9, 0x48, 0x8001}})
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_conn_param_update_req={{0x12, 0xe1, 0x8}, {0x401, 0x1, 0xffff, 0x7a}}}}, 0x15)

04:39:03 executing program 1:
socket$inet(0x2, 0x0, 0x0)

04:39:03 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x23, 0x0, 0x0)

04:39:03 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x1)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00')
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0x800, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0xff01}]}, 0x1c}, 0x1, 0x0, 0x0, 0x28004895}, 0x4)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="02002abd7000fedbdf300600000806001a00af380577"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0)

04:39:03 executing program 5:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 4:
r0 = socket$inet(0x2, 0x4, 0x800)
recvfrom$l2tp(r0, &(0x7f0000000000)=""/233, 0xe9, 0x41, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x10)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 3:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000040)=0x4)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip6tnl0\x00', r2, 0x29, 0x3f, 0x1f, 0x80000001, 0x50, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @remote, 0x7, 0x10, 0x9, 0x1000}})

04:39:03 executing program 5:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

[  834.343298] Bluetooth: Unexpected continuation frame (len 16)
[  834.379463] Bluetooth: Unexpected continuation frame (len 16)
04:39:03 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x4, 0x20010, r0, 0x0)
syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x3, 0x20000)

04:39:03 executing program 3:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0)
sendto$l2tp(r1, &(0x7f0000000180)="ce73ac4f45b8c1a95b0da115a979a4ec88f5a94494d4b983a748817c168ef085d5575d9e5185a6aa29d458eb3c7dad322809887d0832a8f6237891251d8ea4141f62c374adc3fb22cf7fff485730b4d240b87862da7b3fcf53169f059bcb2a4456035bc589322fe410c43a76beebe3c926347e8a27bc30239f09c2d9c47e122175d523ee611937b0fd566e146b68b177a68c5106e0966385c9e004faed8f633d46671118b13375737ed44a1b815f0d2533f5b787c4bdd2988ad06af5b26e96cb61904fd1646a2587b69bf4ba918e87115123515db3f9afee363be1e4cad8b3e4f329", 0xe2, 0x400c800, &(0x7f0000000280)={0x2, 0x0, @multicast1, 0x4}, 0x10)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x29, 0x20, 0x8, 0x0, 0x10, @private1, @dev={0xfe, 0x80, [], 0x35}, 0x8000, 0x40, 0x100, 0x8}})
syz_emit_vhci(&(0x7f0000000140)=@HCI_EVENT_PKT={0x4, @hci_ev_io_capa_request={{0x31, 0x6}}}, 0x9)

04:39:03 executing program 5:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 3:
socket$inet(0x2, 0x5, 0x0)

04:39:03 executing program 4:
r0 = socket$inet(0x2, 0x4, 0x8000003)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:03 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000040)=0x4)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip6tnl0\x00', r2, 0x29, 0x3f, 0x1f, 0x80000001, 0x50, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @remote, 0x7, 0x10, 0x9, 0x1000}})

04:39:04 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x28000)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000000c0)={0xfffffff, 0x8001, 0x9c3, r1, 0x0, &(0x7f0000000080)={0x9b090e, 0xfffffffe, [], @p_u8=&(0x7f0000000040)=0x1}})
ioctl$VIDIOC_SUBDEV_G_FMT(0xffffffffffffffff, 0xc0585604, &(0x7f0000000100)={0x1, 0x0, {0x1, 0x8, 0x3010, 0x4, 0x4, 0x7, 0x0, 0x5}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:04 executing program 2:
syz_emit_vhci(&(0x7f0000000080)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x60}, "1a4a7b305d9008d5fbb5d168829b7a354f4ba658a1bf2ecfe5e8982c8d2cf0831b9432aa0429efc01f9a7a39732114a3b530ccda07c420e51dc5cd9d7400d3328aed479d7870a0d8f1b1ff0768d5d5251500f7a205364ea698bdf43e0fb8e89f"}, 0x64)

04:39:04 executing program 3:
socket$inet(0x2, 0x0, 0x0)

04:39:04 executing program 5:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000040)=0x4)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip6tnl0\x00', r2, 0x29, 0x3f, 0x1f, 0x80000001, 0x50, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @remote, 0x7, 0x10, 0x9, 0x1000}})

04:39:04 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x40010, r0, 0x6000)

04:39:04 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = fork()
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x2000})
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0xfe, 0x80, 0x0, 0x1, 0x0, 0x0, 0x8, 0x4, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2, 0x4, @perf_bp={&(0x7f00000000c0), 0x1}, 0x1a003, 0x5, 0x22, 0x5, 0x7, 0x1, 0x5c}, r0, 0xd, 0xffffffffffffffff, 0x0)

04:39:04 executing program 4:
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0)='nl80211\x00')
r1 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x1b8, 0x8000)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/zoneinfo\x00', 0x0, 0x0)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x74, r0, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x1, 0x1f}}}}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x8001, 0x58}}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r2}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x7f, 0x462}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xe3a, 0x65}}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_PID={0x8}]}, 0x74}}, 0x0)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x24000810}, 0x10000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_NOOP(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="000f27bd7000fbdbdf25000000000500070003000000ea83e4d1e33ceabc3bddff020ec38dab8e2506c7aa5e9bc0e056e19f94a0d74b5621d377cb32a62ccb28b4bf3547a46a14f2e77b444599557633f5c39b6b0f17bcde5a9202821bd890a164b45d59d61f91721227b05bd903755ff3b267cc6dc596a5529aabee1aeff314c0d068058a76fdaa71010dfeb9249261ff51954009e65c70a80150a3a0d976d70d554c5928ca391ff273b532255f300f"], 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x880)
r4 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 5:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 3:
socket$inet(0x2, 0x0, 0x0)

04:39:04 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_SUBDEV_G_FMT(r0, 0xc0585604, &(0x7f0000000040)={0x0, 0x0, {0x7a5b65cb, 0x0, 0x403c, 0x5, 0x7, 0x7, 0x1, 0x5}})

04:39:04 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x4)

04:39:04 executing program 0:
getuid()
r0 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x0)
ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000140))
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680)={0x0, 0x1, 0x6, 0x0, 0x0, 0x0, 0xffffffff})
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f00000001c0)={0x80000000, "31bdbaa8fbb797ea6ed8eef903c279cce5bbf87debfa620862751dd9b75793eb"})
r2 = syz_open_dev$vivid(&(0x7f00000002c0)='/dev/video#\x00', 0x0, 0x2)
ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000300)={0x0, @reserved})
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000280)={'ip6_vti0\x00', &(0x7f0000000200)={'ip6gre0\x00', 0x0, 0x2f, 0x4, 0x0, 0x4, 0x2, @loopback, @private1, 0x8000, 0xe00, 0x3eb, 0xf45}})
ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000000)={0x10004, 0x0, &(0x7f0000ffc000/0x4000)=nil})

04:39:04 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
ustat(0x0, &(0x7f0000000000))
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
accept$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)=@newlinkprop={0x6c, 0x6c, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1a8, 0x4404}, [@IFLA_CARRIER={0x5, 0x21, 0x1}, @IFLA_PHYS_SWITCH_ID={0x8, 0x24, "a04c4fb8"}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x5}, @IFLA_MTU={0x8, 0x4, 0x8000}, @IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @cfhsi={{0xa, 0x1, 'cfhsi\x00'}, {0x14, 0x2, 0x0, 0x1, [@__IFLA_CAIF_HSI_HEAD_ALIGN={0x8, 0x3, 0x800}, @__IFLA_CAIF_HSI_INACTIVITY_TOUT={0x8, 0x1, 0x7}]}}}, @IFLA_LINK_NETNSID={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x891}, 0x44841)

04:39:04 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT={0xff, 0x1}, 0x2)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f0000000080)={0x40000000, 0x7, "170dcab262a3f8d6c822bb8932118359643a92cd09892ff66c9f8fa86445fdef", 0x9, 0x2, 0x6, 0x4, 0x5290, 0x81, 0x1, 0x0, [0x6, 0x1000, 0x7, 0x7f]})

04:39:04 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)

04:39:04 executing program 3:
socket$inet(0x2, 0x0, 0x0)

04:39:04 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x0)
mmap$fb(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x6, 0x100010, r0, 0xe2000)

04:39:04 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r1=>0x0}, &(0x7f0000000140)=0xc)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r1, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)

04:39:04 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
mmap$usbmon(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0xc, 0x40010, r0, 0xb)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x44040)
ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000040)={0x1ff, 0x0, &(0x7f0000ffc000/0x4000)=nil})

04:39:04 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:39:04 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/consoles\x00', 0x0, 0x0)
r2 = fork()
r3 = syz_open_procfs$namespace(r2, &(0x7f0000000000)='ns/net\x00')
r4 = accept4(r3, 0x0, &(0x7f0000000200), 0x80800)
r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000280)='gtp\x00')
sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000000340)={&(0x7f0000000240), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r5, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_LINK={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_VERSION={0x8}]}, 0x2c}}, 0x0)
sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x43434378e8f94742}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x0, 0x34fb961316719945, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x35208b1cfa2c5142}, 0x1)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r4, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void, @void}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x5d}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0x39}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008000)
r6 = accept4(r4, 0x0, &(0x7f00000005c0), 0x800)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x64, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_FLOW={0x6}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_VERSION={0x8}]}, 0x64}}, 0x0)
sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r5, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_MS_ADDRESS={0x8, 0x5, @private=0xa010102}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r1=>0x0}, &(0x7f0000000140)=0xc)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r1, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x3, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_cmd_rej_unk={{0x1, 0x6, 0x2}, {0x1f}}}}, 0xf)

04:39:04 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff3000/0x2000)=nil, 0x2000, 0x1000000, 0x110, r1, 0x56000)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:04 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r1=>0x0}, &(0x7f0000000140)=0xc)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r1, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x1, 0x14}, @l2cap_cid_signaling={{0x10}, [@l2cap_disconn_req={{0x6, 0x9, 0x4}, {0x2, 0x400}}, @l2cap_disconn_rsp={{0x7, 0x48, 0x4}, {0xda, 0x80}}]}}, 0x19)
syz_emit_vhci(&(0x7f0000000080)=@HCI_SCODATA_PKT={0x3, {0xc8, 0xbb}, "daf721c98b7a7300f54795e2ef7d291dc0a04c8d6f1826fa504094c3e8c5db1215b8625e0b5c90ef7873c08539a9aee4ff0e4f2a565c803486240a5f676ed0dc194b1267c809000000d42d621d1b3eb37475e8bed0157696e631ba24817e96f84909062d14bedd0ca265cb28b91140822d8b5a23076c6073bb10407ad9f2f916e268faf62288c975764b2c88609dfcd2ba29d428f410966171abcbbf149ee48c1ebd349bd4cd39a4e8916acf06a54a32b0bbbe3c448e05ca840914"}, 0xbf)

04:39:04 executing program 1:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0xc4040)
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000140)={0x0, 0x8, 0x7, 0x800, r0})
setns(r0, 0x10000000)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00')
ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000100)={0xf000000, 0x7, 0x7fffffff, r2, 0x0, &(0x7f00000000c0)={0x990a6a, 0x4, [], @p_u16=&(0x7f0000000080)=0x5}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:04 executing program 4:
socket$inet(0x2, 0xa, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x5, 0xe180)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000100)={0x0, @ax25={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7}, @l2tp={0x2, 0x0, @empty}, @ipx={0x4, 0x7ff, 0x2, "2bbb05e37b9c", 0x3}, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6f})
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}, &(0x7f00000000c0)=0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0xd7, 0x4000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000180)={@private, @empty}, &(0x7f00000001c0)=0xc)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
connect$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @loopback, 0x4}, 0x10)
socket$l2tp(0x2, 0x2, 0x73)
getsockopt$inet_mreqn(r1, 0x0, 0x20, 0x0, 0x0)

04:39:04 executing program 1:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 5:
socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r1=>0x0}, &(0x7f0000000140)=0xc)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r1, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 2:
r0 = fork()
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x805, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x27}, @val={0x8}, @void}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_PID={0x8, 0x52, r0}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x74}, @NL80211_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2008001}, 0x44004)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04330a00000000000007000800"], 0xd)

04:39:04 executing program 0:
ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000100)={0x2, {0x1ff, 0x7c, 0x8, 0x80000001}})
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = syz_open_dev$vivid(&(0x7f0000000040)='/dev/video#\x00', 0x1, 0x2)
r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x400000000008, 0x400142)
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f00000000c0)={0x7, 0x5, 0x2, 0x80000, r1})
syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0)

04:39:04 executing program 4:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@ipv4_newnexthop={0x1c, 0x68, 0x400, 0x70bd2a, 0x25dfdbfe, {0x2, 0x0, 0x1, 0x0, 0x10}, [@NHA_FDB={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8800)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
r0 = socket$phonet_pipe(0x23, 0x5, 0x2)
getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4)

04:39:04 executing program 3:
socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r0=>0x0}, &(0x7f0000000140)=0xc)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:04 executing program 1:
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:04 executing program 5:
socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_CROP(r2, 0xc014563b, &(0x7f0000000100)={0x9, {0x6, 0x1, 0x29f, 0x1}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x4, 0xee, 0x20, 0x3ff, 0x61, @mcast1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x7800, 0x7, 0x9, 0x4cce}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:05 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r0, 0xb703, 0x0)
ioctl$NS_GET_USERNS(r0, 0xb701, 0x0)
msgctl$IPC_STAT(0x0, 0x2, &(0x7f0000000040)=""/4)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0)
r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r3, 0xb703, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @void}}, [@NL80211_ATTR_NETNS_FD={0x8, 0xdb, r0}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r2}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r3}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
socket$inet(0x2, 0x4, 0x7)

04:39:05 executing program 3:
socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r0=>0x0}, &(0x7f0000000140)=0xc)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
mmap$perf(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8, 0x10010, r1, 0x5)
ioctl$VIDIOC_G_JPEGCOMP(r1, 0x808c563d, &(0x7f0000000040))
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000000)={0x1, {0x6, 0x81, 0x244}})
ioctl$VIDIOC_ENCODER_CMD(r1, 0xc028564d, &(0x7f0000000100)={0x2, 0x1, [0xfc, 0x9, 0xa67, 0x0, 0x8, 0x9, 0xddc, 0x9]})

04:39:05 executing program 5:
socket$inet(0x2, 0x5, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 5:
r0 = fork()
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x805, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x27}, @val={0x8}, @void}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_PID={0x8, 0x52, 0xffffffffffffffff}, @NL80211_ATTR_PID={0x8, 0x52, r0}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x74}, @NL80211_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2008001}, 0x44004)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04330a00000000000007000800"], 0xd)

04:39:05 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x4000)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000f5a000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000986000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000040)="3d2ce83ebb2cf84e3ebd1ea37eaa6e9cb0c75f273e134f763a43d6f922b137434a98074e85bbc6848fdda39da98f5aafdeae15c031615c724af50efce03f7547c785c1d1303ce7aa1fe38f4f5d602adc005f38953c78c82af74d6ae890839ed8d7315ddbb01b5c5c9420cc5b26689b5054ce931d7cad135b938124695792d6241602282a6c647d580b4550ff2f7ece284d5c6c6c7034abcfb646b2bbb28c32706b314cf70e46e3e851838854f40bdcdc", 0xb0, r0}, 0x68)
ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000180)={0x80000000, "60163b8ea2b072203882ffb3a12757a7e47f6b2cf8dca7cebf49a3df693bdedb", 0x3, 0x200, 0x1a9, 0x5, 0x1, 0x6, 0x2614, 0x3a})

04:39:05 executing program 3:
socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r0=>0x0}, &(0x7f0000000140)=0xc)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_SCODATA_PKT={0x3, {0xc9, 0xb0}, "4232cf08c436782001813e911aac869742d9bf48ab84d01573d76c68b3f5e9c495eb9c278c317bfacf1fa162a13780247d262f4a12d2738abb4aadf25d9f49e4c9a6a6fcdbdad73aec02449e4f0bb2ae903b1c7088f2326e2a7e0bba579ab749640b5315886e167ffd815760380c536ac411e97bf85e1ddcc2f1606fa317cefc2c7c6f07f9e20712fa57fa8c46ddf801495b7f463e387e00fbe627d969199d05a664545f11a5f4f592dfd6e8ea915361"}, 0xb4)
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000100)="ab808ca8ca00ed3bc64b987ff10cecb1f776eafc24fcdde4987d38382df82d5565cf34437eb2f027ddb4ea3b6bafaedb7785e2f03ab69493f1a4af177905677c742279fb9b49c8783d03b56db3da3ee65361aa0546dd2c1ba8672f47d0ef427db142d3ec563aafbf98f28b9afff7de0a7af91eab975564a2924255f4d61206ccf539a3197f6e6e1f55ee5aaad6044b8d405ddd87f2a9b690e7329df9de7f60b27ebea786873213db4084943cf90ab6fc2915fd69ce0ae80fb0683769b6d1abfd84e34cf2", 0xc4, 0x0, &(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, 0x10)

04:39:05 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 0:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff9000/0x2000)=nil, &(0x7f0000fef000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fef000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000000040)="d1ef328fc756a58c10d960e8ac67985596297a88df9e4c2b59dd7ceeb14b63", 0x1f}, 0x68)
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:05 executing program 3:
socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@empty, @multicast2, <r0=>0x0}, &(0x7f0000000140)=0xc)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', r0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x10000)
socketpair(0x1e, 0x800, 0xbf66, &(0x7f0000000000))
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
msgget$private(0x0, 0x221)

04:39:05 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
shmget(0x3, 0x4000, 0x205, &(0x7f0000ff4000/0x4000)=nil)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
mmap$dsp(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x5, 0x11, r1, 0x0)

04:39:05 executing program 3:
socket$inet(0x2, 0xa, 0x0)
semctl$SEM_STAT_ANY(0xffffffffffffffff, 0x3, 0x14, &(0x7f0000000080)=""/147)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@private, @remote}, &(0x7f0000000040)=0xc)

04:39:05 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 2:
syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="03c800e6954db87330bf1c1e5fa71dc966c3a6caee64b55a98a77bf131d7c2e5cb8fc8d6455d4d41bb205d55311d191b37be1dac825de1ca0ff89afbf3a0d6b453e6bab232d66ae48700ecc8273af9fb110230cd38bf1020c3144396d24b141c6c1a3449948f5e487b4afd295a2d0ec2ed3227ab7f8ada0ff693b6b1a5facf65709c32bcdd9e28da94faf6fbd0722ce54c2921d79169702e1306000000577def320b03295bbfbe0c8cb427354e17f0fdefeff37b9214b124f5ff86e3dfcf0a999cee51d07aaa1397040a82994245d171389de08d0db200"/233], 0xffffffffffffff3b)
msync(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2)
arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x7fff)
shmget$private(0x0, 0x4000, 0x4, &(0x7f0000ffc000/0x4000)=nil)
r0 = fork()
syz_open_procfs$namespace(r0, 0x0)
ptrace$getregs(0xe, r0, 0x9, &(0x7f0000000000)=""/84)

04:39:05 executing program 3:
socket$inet(0x2, 0xa, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x40, 0x684800)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:05 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 1:
socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 4:
r0 = socket$inet(0x2, 0x6, 0x1)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x78, r3, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x325d}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_COOKIE={0x6, 0xf, 0x4}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x11c}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000000080)="e1472667843bfef0d5720cdd7b8079", 0xf, r1}, 0x68)
getpeername$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000040)=0x10)
getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0)

04:39:05 executing program 2:
set_robust_list(0x0, 0x0)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x20000, 0x0)
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1)
move_pages(0xffffffffffffffff, 0x4, &(0x7f0000000040)=[&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil], 0x0, &(0x7f0000000080)=[0x0], 0x2)

04:39:05 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)
socket$inet(0x2, 0xa, 0x0)

04:39:05 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x0, 0x400200)

04:39:05 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 1:
socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2)
ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f0000000280)={0x3ff, 0x5, 0x2e, "a3363aa8441efbe0ca75506fd49a9e3b3bd774f7d57bb60e4deda57c1f57ccd3bbb7537359b21280385097bd6927165f70421e52fd44f4a4cfacf9e7", 0x13, "5048d715e144469a7dad5884d5f7173f7a0890ed08c1dfd2c969b9210690489fbfc667a4ec8405faba6b199f5b385c22ad8d2167ff1e6ab003aaf089"})
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000000c0)={0xb, 0x100, 0x3, 0x84000, r0})
ioctl$VIDIOC_G_JPEGCOMP(r0, 0x808c563d, &(0x7f0000000340))
ioctl$VIDIOC_G_OUTPUT(r1, 0x8004562e, &(0x7f00000001c0))
ioctl$VIDIOC_S_AUDOUT(r2, 0x40345632, &(0x7f0000000080)={0x3, "3e2c1eb778db24823c88c7b0adb10516cabe48ff5694cae1e54bc120aea79ba5", 0x1})
ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0)
ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000100))
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000ff7000/0x3000)=nil, 0x3000}, &(0x7f0000000240)=0x10)

04:39:05 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:05 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0x0, 0x0, 0x1, 0x1c}, @l2cap_cid_le_signaling={{0x18}, @l2cap_ecred_conn_req={{0x17, 0x7c, 0x14}, {0x81, 0x912, 0x0, 0x3, [0x3090, 0x86, 0x0, 0x7, 0x8, 0x9]}}}}, 0x21)

04:39:05 executing program 1:
socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:05 executing program 3:
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 0:
semctl$GETVAL(0x0, 0x6, 0xc, &(0x7f0000000040)=""/117)
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:05 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
inotify_rm_watch(0xffffffffffffffff, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000040)={0x4, {0x6, 0x2, 0x0, 0x20}, {0xffffff7f, 0x1, 0x5, 0x3}, {0x8000, 0xff}})

04:39:05 executing program 5:
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:05 executing program 2:
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="041c05818c62c8002f05f04cb1e4afec2c2fb8683df03fd90cb2542901300b117a75a3c3a34d7b68a9cb93"], 0x8)
accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800)
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x3, 0x1a}, @l2cap_cid_le_signaling={{0x16}, @l2cap_ecred_conn_req={{0x17, 0x2, 0x12}, {0x9, 0x9, 0x7f, 0x8001, [0x2, 0x339, 0x3, 0x0, 0x0]}}}}, 0x1f)

[  836.452673] Bluetooth: hci2 ACL packet for unknown connection handle 0
04:39:05 executing program 3:
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:05 executing program 1:
socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

04:39:06 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000})
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0)
ioctl$VIDIOC_SUBDEV_S_SELECTION(r1, 0xc040563e, &(0x7f0000000080)={0x1, 0x0, 0x102, 0x0, {0x16c, 0xe538, 0x9, 0x2ed}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
getpeername$l2tp(r0, &(0x7f0000000100)={0x2, 0x0, @empty}, &(0x7f0000000140)=0x10)

04:39:06 executing program 5:
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000080)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x1, 0x16a}, @l2cap_cid_signaling={{0x166}, [@l2cap_info_req={{0xa, 0x4, 0x2}, {0x9}}, @l2cap_conf_rsp={{0x5, 0x20, 0x24}, {0x7, 0x3, 0xfc, [@l2cap_conf_flushto={0x2, 0x2, 0x20}, @l2cap_conf_efs={0x6, 0x10, {0x9, 0x0, 0x1000, 0x0, 0xfff, 0x40000}}, @l2cap_conf_flushto={0x2, 0x2, 0x4}, @l2cap_conf_flushto={0x2, 0x2, 0x6}]}}, @l2cap_conf_req={{0x4, 0x6c, 0x2d}, {0x7, 0x4, [@l2cap_conf_mtu={0x1, 0x2, 0xfffd}, @l2cap_conf_ews={0x7, 0x2, 0x5f}, @l2cap_conf_mtu={0x1, 0x2, 0x1}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_flushto={0x2, 0x2, 0xc000}, @l2cap_conf_flushto={0x2, 0x2, 0x7}, @l2cap_conf_efs={0x6, 0x10, {0x3, 0x0, 0x4, 0x8, 0xeb082460, 0x8}}]}}, @l2cap_move_chan_cfm_rsp={{0x11, 0x40, 0x2}, {0x7}}, @l2cap_info_rsp={{0xb, 0x2, 0xcf}, {0x7ff, 0x0, "f178934e72ba89c55829b53c5434018c8abc241175376e08c7547998062c7f5966cbaf984ff381d9e2ed905faf69b7aa7678b27ca02de515b8424b044f4eb1a272230118e3ce409f35aa9f311d43b5cae1c815ce18a67ec1d26379ffa7aedd8e064bfdee91f2629a6d3a4c2e74eb7ee187efdc95a72a45f3b00099ffcb6b741e522d46ac2e5f3f887a8d928693570b95c6704b0cdc1d8ef51707356ab56132a3fe5f0fa96e8543625310e33f9cfde95a32f1bc6901cd31b84a8f9469e898607c4e4af35d9f09f093606ec4"}}, @l2cap_disconn_rsp={{0x7, 0x7, 0x4}, {0x4, 0xd4}}, @l2cap_conf_req={{0x4, 0x8, 0x22}, {0xdc11, 0x1f, [@l2cap_conf_flushto={0x2, 0x2, 0xffff}, @l2cap_conf_flushto={0x2, 0x2, 0x6}, @l2cap_conf_rfc={0x4, 0x9, {0x1, 0x5, 0x9, 0x2, 0x47, 0xffff}}, @l2cap_conf_rfc={0x4, 0x9, {0x2, 0xaa, 0x1, 0x3ff, 0x38f, 0x17}}]}}]}}, 0x57)

04:39:06 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x8)
getsockopt$inet_mreqn(r0, 0x0, 0x23, 0x0, 0x0)
accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
inotify_rm_watch(0xffffffffffffffff, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000040)={0x4, {0x6, 0x2, 0x0, 0x20}, {0xffffff7f, 0x1, 0x5, 0x3}, {0x8000, 0xff}})

04:39:06 executing program 3:
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', &(0x7f0000001780)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x0, 0x5, 0x22, @private2, @mcast2, 0x1, 0x8, 0x384, 0x6}})

04:39:06 executing program 5:
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r2=>0xffffffffffffffff})
recvfrom$l2tp(r2, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')
sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x96}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6c1f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x80)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000040)="8920b3501fefafd604", 0x9}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/consoles\x00', 0x0, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f0000000180)=0x10)
ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0xa30000, 0x9, 0x6, r0, 0x0, &(0x7f00000000c0)={0xa00904, 0x84, [], @string=&(0x7f0000000140)=0x1}})
ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000001c0)=<r3=>0x0)
setuid(r3)
ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f0000000040)={0xa, {0x40000, 0x400, 0x0, 0x1}, {0x80, 0x9, 0x4, 0x7}, {0x10001, 0x1}})
r4 = syz_open_dev$vivid(&(0x7f0000000200)='/dev/video#\x00', 0x3, 0x2)
ioctl$VIDIOC_G_EDID(r4, 0xc0285628, &(0x7f0000000280)={0x0, 0x100, 0x1ff, [], &(0x7f0000000240)})

04:39:06 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
inotify_rm_watch(0xffffffffffffffff, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000040)={0x4, {0x6, 0x2, 0x0, 0x20}, {0xffffff7f, 0x1, 0x5, 0x3}, {0x8000, 0xff}})

04:39:06 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000000)={0x6, 0x0, 0x1015, 0xc0, 0x9, 0x20, 0x3000})

04:39:06 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
inotify_rm_watch(0xffffffffffffffff, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000040)={0x4, {0x6, 0x2, 0x0, 0x20}, {0xffffff7f, 0x1, 0x5, 0x3}, {0x8000, 0xff}})

04:39:06 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0)

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x1, 0x2, 0x43}, @l2cap_cid_signaling={{0x3f}, [@l2cap_conf_req={{0x4, 0x81, 0x4}, {0x1, 0x2}}, @l2cap_move_chan_req={{0xe, 0x1, 0x3}, {0x100, 0x4}}, @l2cap_conn_rsp={{0x3, 0x9, 0x8}, {0xfff9, 0x8, 0x7, 0x200}}, @l2cap_move_chan_rsp={{0xf, 0x36, 0x4}, {0x1f, 0x9}}, @l2cap_move_chan_cfm_rsp={{0x11, 0x91, 0x2}, {0xffff}}, @l2cap_disconn_rsp={{0x7, 0x6, 0x4}, {0x20, 0x7}}, @l2cap_info_req={{0xa, 0x1f, 0x2}, {0x101}}, @l2cap_disconn_req={{0x6, 0x2, 0x4}, {0x7, 0x81}}]}}, 0x48)

04:39:06 executing program 0:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00022dbd7000fbdbd7251200000008002c00c2000001"], 0x1c}, 0x1, 0x0, 0x0, 0xc4}, 0x80)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r2 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x2, 0x2)
r3 = accept4(r0, &(0x7f00000001c0)=@rc={0x1f, @fixed}, &(0x7f0000000240)=0x80, 0x800)
ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000300)={0xa10000, 0x9, 0x6, r3, 0x0, &(0x7f00000002c0)={0x9c0907, 0x0, [], @string=&(0x7f0000000280)=0x81}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r1, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0x7, 0x2000)
r5 = syz_open_dev$vivid(&(0x7f0000000480)='/dev/video#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_S_SELECTION(r5, 0xc040563e, &(0x7f00000004c0)={0x0, 0x0, 0x103, 0x4, {0x2, 0x1, 0x5, 0x2}})
sendmsg$BATADV_CMD_SET_HARDIF(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, 0x0, 0x10, 0x4, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x20}}, 0x4008004)

04:39:06 executing program 4:
r0 = fork()
r1 = fork()
socketpair(0x21, 0x6, 0x3f, &(0x7f0000000240)={<r2=>0xffffffffffffffff})
sendmsg$nl_route(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@RTM_NEWNSID={0x34, 0x58, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@NETNSA_PID={0x8, 0x2, r1}, @NETNSA_FD={0x8}, @NETNSA_PID={0x8, 0x2, r0}, @NETNSA_FD={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004004}, 0x440e4)
sched_getparam(r0, &(0x7f0000000000))
r3 = fork()
wait4(r3, &(0x7f0000000040), 0x1, &(0x7f0000000080))
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, 0x0, 0x0)

04:39:06 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
inotify_rm_watch(0xffffffffffffffff, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))

04:39:06 executing program 0:
capset(&(0x7f0000000040)={0x400e204c}, &(0x7f0000000080)={0x4, 0xfffffffb, 0x4, 0x18, 0x5, 0x10001})
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0)

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="0001000dfa0800f800001008003f00020004000600f0ff118102000000034408000000ffff0080010000000042170a181eedd3ee44eb2550654a9897efb1a8be9f4cfbdfe622ad130891a68df13363178ead945c795499d0f161fe8ec888c0077553016bcddc361f5b2e3099398d6bbb522eb4b37a9cb34f10886fbf7452ceec46494bc39857a8f2e88d42e008320f64de390aae710dac823dca44705195c83ad816735b16ec2e4effd9ee95634afc87404a45e2a30f5654ed14f4ad138244b770e6705a5a7b9d4695655cc265a6e2fbdd6be569cdd03304fae37a0909b4a6d5c55dcaef373a6b6fdac007f4b7798da7311fc6f160b04b1e89977f7d9afcd39cf4afb7c4ff3a0d51"], 0x2f)
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00')
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4890}, 0x40000)

04:39:06 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x927)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
inotify_rm_watch(0xffffffffffffffff, 0x0)

04:39:06 executing program 0:
syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0x3, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0)
r2 = fork()
r3 = syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/time_for_children\x00')
ioctl$NS_GET_NSTYPE(r3, 0xb703, 0x0)
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xb4, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r1}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x3}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r3}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x880}, 0x48044)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000001800)={'ip6_vti0\x00', 0x0})

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT={0xff, 0x1}, 0x2)

04:39:06 executing program 4:
move_pages(0xffffffffffffffff, 0x4, &(0x7f0000000200)=[&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil], &(0x7f0000000240)=[0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2)
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYRESDEC=r0, @ANYRESOCT=r1, @ANYBLOB="00002bbd7000fcdbdf250100000005001400b900000006000e00040000000c000f0000000100ffffffff05002136181f8e0006001a004e230000"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0xc1c0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'})
r2 = socket$inet(0x2, 0x80000, 0x2)
getpeername$l2tp(r2, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)

04:39:06 executing program 5:
socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00022dbd7000fbdbd7251200000008002c00c2000001"], 0x1c}, 0x1, 0x0, 0x0, 0xc4}, 0x80)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r2 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x2, 0x2)
r3 = accept4(r0, &(0x7f00000001c0)=@rc={0x1f, @fixed}, &(0x7f0000000240)=0x80, 0x800)
ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000300)={0xa10000, 0x9, 0x6, r3, 0x0, &(0x7f00000002c0)={0x9c0907, 0x0, [], @string=&(0x7f0000000280)=0x81}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r1, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0x7, 0x2000)
r5 = syz_open_dev$vivid(&(0x7f0000000480)='/dev/video#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_S_SELECTION(r5, 0xc040563e, &(0x7f00000004c0)={0x0, 0x0, 0x103, 0x4, {0x2, 0x1, 0x5, 0x2}})
sendmsg$BATADV_CMD_SET_HARDIF(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, 0x0, 0x10, 0x4, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x20}}, 0x4008004)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))

04:39:06 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x3, 0x2, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_rsp={{0x15, 0x5, 0xa}, {0x2, 0x6, 0xd980, 0x82, 0x2}}}}, 0x17)
ioctl$NS_GET_NSTYPE(0xffffffffffffffff, 0xb703, 0x0)
ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0)

04:39:06 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r2=>0xffffffffffffffff})
recvfrom$l2tp(r2, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')
sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x96}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6c1f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x80)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000040)="8920b3501fefafd604", 0x9}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 5:
socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x3)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80004000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newnexthop={0x28, 0x68, 0x10, 0x70bd29, 0x25dfdbfd, {0x2, 0x0, 0x1, 0x0, 0xc}, [@NHA_ID={0x8}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4)

04:39:06 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
inotify_rm_watch(r0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xa0000000, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r1, 0x0)

04:39:06 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)

04:39:06 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r2=>0xffffffffffffffff})
recvfrom$l2tp(r2, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')
sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x96}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6c1f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x80)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000040)="8920b3501fefafd604", 0x9}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x40010, r0, 0x0)

04:39:06 executing program 5:
socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10)

04:39:06 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0xfffffec1)

04:39:07 executing program 1:
socket$inet(0x2, 0xa, 0x3)
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))

04:39:07 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r2=>0xffffffffffffffff})
recvfrom$l2tp(r2, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')
sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x96}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6c1f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x80)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000040)="8920b3501fefafd604", 0x9}, 0x68)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(r0, 0x0, &(0x7f0000000040))

04:39:07 executing program 4:
clock_gettime(0x0, &(0x7f0000000000)={<r0=>0x0, <r1=>0x0})
clock_gettime(0x0, &(0x7f0000000040)={<r2=>0x0, <r3=>0x0})
setitimer(0x1, &(0x7f0000000080)={{r0, r1/1000+60000}, {r2, r3/1000+60000}}, &(0x7f00000000c0))
r4 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r4, 0x0, 0x0, 0x0, 0x0)

04:39:07 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_sync_conn_complete={{}, {0x84, 0xc8, @any, 0x1, 0x43, 0x93, 0x401, 0x8, 0x80}}}, 0xfffffedf)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_ENUM_DV_TIMINGS(r1, 0xc0945662, &(0x7f0000000180)={0xffff, 0x0, [], {0x0, @reserved}})
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
syz_emit_vhci(&(0x7f0000000140)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000080)="99b8010000000f01c1f3400faed70fc75d78c40189653c7e66baf80cb8a0cbb68bef66bafc0c66b8007866ef47f75300b8010000000f01d966b8a0008ed865470f0013", 0x43}], 0x1, 0x8, &(0x7f0000000100)=[@cr0={0x0, 0x38}, @vmwrite={0x8, 0x0, 0xb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x401}], 0x2)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00'})

04:39:07 executing program 1:
socketpair(0xf, 0xa, 0x1, &(0x7f0000000000))

04:39:07 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x80000b, 0x40010, r0, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_ENCODER_CMD(r1, 0xc028564d, &(0x7f0000000040)={0x3, 0x0, [0x10001, 0x80000000, 0x892, 0x3, 0x5d4, 0x3, 0xca5, 0x2]})

04:39:07 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r2=>0xffffffffffffffff})
recvfrom$l2tp(r2, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')
sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x96}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6c1f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x80)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000040)="8920b3501fefafd604", 0x9}, 0x68)

04:39:07 executing program 2:
socket$nl_route(0x10, 0x3, 0x0)
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00')
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010025bd7000ffdbdf25010000000c0010000300000000000000140008006272696467653000000000000000000006001c000900000008001800acbc153f55f5f192f37aaf91691414bb06000e00"], 0x54}, 0x1, 0x0, 0x0, 0x4044004}, 0x900)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000040)=@HCI_SCODATA_PKT={0x3, {0xc8, 0xd4}, "44c8f16fa025d5f8f32caa3d4907e2ea772c07c2f8d39dbe0efc304bb35d51a2daabefc6e3cfb6d4d5ae23c68712fafb403998c9716624d94af020d7028ddcf18a81c3e069339eab19b93067c51b5d21bd4ca8d1440d66444f0510a4b6611647cab59c5d410f59cb8e7a6fa8e06d7c86537cc2afb2175e2fbce9cd44d1ad00f2f87e1ba7bcfb76da9badf59b657a0377dd606203c69c3d15dde7963672aef6e56a539fbc7c87364f5a527f922a3a2eeacd83a06f8c082549386b15b781c1366da708761ab1d4a6556a7cdf6ed97c53008dc42761"}, 0xd8)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000400)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r3, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000)
sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xf8}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x4004080)

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:07 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x7}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040010}, 0x10)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:07 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x444140)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
pkey_mprotect(&(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x2000000, 0xffffffffffffffff)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
syz_kvm_setup_cpu$x86(r1, r0, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000040)="2e0f79890000f30f090fc7b31e000fc734b86b008ec83e3e0f01df660fc77346f0834086588fe968012c0f01c8", 0x2d}], 0x1, 0x8, &(0x7f00000000c0)=[@vmwrite={0x8, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffbff}], 0x1)
pkey_mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0xffffffffffffffff)

04:39:07 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r2=>0xffffffffffffffff})
recvfrom$l2tp(r2, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')
sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x96}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6c1f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x80)

04:39:07 executing program 1:
socketpair(0x0, 0xa, 0x1, &(0x7f0000000000))

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:07 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x38fe)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
accept$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:07 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000000c0)={0x9a0000, 0x101, 0x81, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x9909d7, 0xe4b, [], @p_u32=&(0x7f0000000040)=0x5}})

04:39:07 executing program 1:
socketpair(0x0, 0xa, 0x1, &(0x7f0000000000))

04:39:07 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r1=>0xffffffffffffffff})
recvfrom$l2tp(r1, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00')

04:39:07 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xa, 0x200)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
mmap$fb(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000001, 0x30, r0, 0xb5000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x9})

04:39:07 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = fork()
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000014c0)='ns/cgroup\x00')
syz_open_procfs$namespace(r1, 0x0)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, 0x0, 0x400, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0xe}, @void, @void}}, [@NL80211_ATTR_NETNS_FD={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x4b}, @NL80211_ATTR_PID={0x8, 0x52, r1}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x200020c0)
socketpair(0x1e, 0x5, 0x2, &(0x7f0000000000)={<r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00')
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x29, 0x9, 0x9, 0x5, 0x45, @private1={0xfc, 0x1, [], 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1, 0x20, 0x8, 0x10004}})
recvmsg$can_bcm(r2, &(0x7f0000001600)={&(0x7f0000000340)=@pppol2tp={0x18, 0x1, {0x0, <r4=>0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000001500)=[{&(0x7f00000003c0)=""/223, 0xdf}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)}], 0x3, &(0x7f0000001540)=""/140, 0x8c}, 0x100)
sendmsg$L2TP_CMD_TUNNEL_DELETE(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="10002dbd7000ffdbdf250215000005007965600ea808ceaee5000005000d0000090000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x400000d1)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockname$l2tp(r0, 0x0, 0x0)

04:39:07 executing program 1:
socketpair(0x0, 0xa, 0x1, &(0x7f0000000000))

04:39:07 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340)={<r1=>0xffffffffffffffff})
recvfrom$l2tp(r1, &(0x7f0000000380)=""/66, 0x42, 0x10040, 0x0, 0x0)

04:39:07 executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000080)="baf80c66b8de7aa68a66efbafc0cb86b90efbaf80c66b874ae108766efbafc0c66edbaf80c66b87ca6cb8b66efbafc0cedbad10466b80000008066ef660f6794926a260f01cf0f01cbf00fba7171660f2158baf80c66b8d006448566efbafc0c66b8a236dcbb66ef", 0x68}], 0x1, 0x0, &(0x7f0000000140)=[@dstype0={0x6, 0xa}], 0x1)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
mmap$usbmon(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x200000c, 0x10, r0, 0x100000001)

04:39:07 executing program 0:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0xe000, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x30, r0, 0x0)

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x38fe)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
accept$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:07 executing program 4:
geteuid()
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x300, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x3f}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xfd}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x400}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_COOKIE={0xc}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008080)

04:39:07 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
accept4(r0, &(0x7f0000000100)=@hci, &(0x7f0000000180)=0x80, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340))

04:39:07 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
ioctl$NS_GET_NSTYPE(r0, 0xb703, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000680))
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000001c0)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff4000/0x9000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ff2000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000000c0)="ab6470b5e805025b5582da32f11df6489e2a06f909782dc83356e499df7918f3c67f99ff4149d1d574dc64de79cd20f4c38cfb365ffd353842c3b0fcd40990780b826ea3ab8439f6afdeb5fe3e333747beb27fdc76521884eeb15b506a96984fd13d7778ed15c7391643eea736301748ba3afb3578d13233e5b41e49d0b5aeb5f65b5ed763b6d864ea83e743e091964d793ab58b443fdae78e489926e5c95ff553aa59c8f470fab3a8e33909e71b244a134d99cbfe5da9c7630580fb5d60b730c2c64cdf3123a0e8d725b4225400631445215b63d5eaa24607d54cdb8978716684e92257a0fc043e1c4bf511e43d5748", 0xf0, r2}, 0x68)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0xa})

04:39:07 executing program 1:
socketpair(0xf, 0x0, 0x1, &(0x7f0000000000))

04:39:07 executing program 2:
syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @extended_inquiry_info={{0x2f, 0x9ed}, {0xa, [{@any, 0x6, 0x3f, "a600b0", 0x40, 0x2, "cc851e2083174e92feb7eade58ecaabe3ba1faad01f95c0755f7332d5653e32df2bd46eb94484c4040b412a0b349abf0a8c259aa28fa6706d88dac1f651aaff283dc7a3d8f9d1e34d6d87d54f707a2360ef89774343afff708d1d358263acc4ac6251bee09e6f1b162060473442cf32af28843f5032216c340a4fea6f44522fd338cb2e2d5bf2a9fa6863388b96d4ea24f58d8c69c8820705ffff4fe81c5be7aee5c6472ee2608367787d37c3d7722eab5d673669742af74cc64593e9efc45d4b807b3913cae3241356e8f622c2c7f8b9128c5540dbef6fb1685cb665e78182c14c8e6c36e2229523310b8daf77e8701"}, {@any, 0x5, 0x3, "982742", 0x5, 0x81, "55dc0860e974dfc0b5026af9a0a27d2bab51860546f33f2e1143bd7c08848e8ff4f7f14a983b0ba004a0f19339db57af53092a8e52a281e254faa046b7dc33005a5463eb85a2e06036a0ae7d0c0cd3461d997b9d03d36987a56481262ace4570bd06eed1d67f4acece8ce13cddbebe72a06ea8f78549548ba2ea34089874c97a9bf141637e419fc56c23fa19b7ce7289b12f5947d2b7b465cf1b72fdfad104ec43912db1775811439ff1377ec30d4a4597b2fbf1a41a13c41c77ea79359e7dc31f5fdf3ae4abe600af2da2938b0775418bee6788fb7adf7a1cd9f4b00cd58f12ecc9fc3ebff4c113dff2d3ba4a5644f9"}, {@fixed={[], 0x12}, 0x1f, 0x1, "4e5e06", 0x7, 0x6, "785cd8847dec7f0d35af2c06795fa9636ca122699435c71ccbd953b75b9442c5999014d906a78589f548c1c9500b3daf2a3e5768257ad8a954d00a54103d9e21e80aa525f8aec99f6667ea64c0f1dbd51c98b0d462e3acb9785958249954eaf9ac18c213931a0fcd954e7d71071e90176b5030714ef2a8c2c1b4b8dae42a8d741dddbcd03ce4a0fad3960bc5792ce73d51de47ecef64c72343d053f73eb88d5753cc6662f73451543d8337527739c2a58335991d35dbdfb88f77db93c3e61d936bedc680a62a4fd428c714c1e2902e3dc061c117689b8d38f3a50b5755d166b758a232e2e71c16695a8ec794bb1c7cf5"}, {@any, 0x3, 0x8, "63e6ab", 0x8000, 0xcf, "3db0e54273e8969300158a7e918bbe2b5265918cbe88fa2d84b44b36e29544ddfb24704ee059a4e33dd18862784ef0bbbf1be21bb3ec428258e31faaed45ff0a5dea65dbfa18c33f08e515101177e11b0fd7dfe6a5a029c1fce8e71991453591e8236218330ca20671a62dc510481f690dd212c64893ef799ee8b834388e79f9c0bd1c07dd921e06df6951e313a784412447ce9153e5ed4e1116c3b544a75e2ed217343183168d31fb41aaf2e6e2b92bcc8924c0200fe7500341562eb5278012ad8c8cedca25688bf7399e7212e9750f771527e7830d8b33c5a9f79ae6ff182fb1b47581d853942c68d90d2c6e176e99"}, {@any, 0x81, 0xac, "9e3a3a", 0x9, 0x81, "2b021c6799a268902877488dca7d1f1378707e91434583c8aede7628265da24699188a3c63b7ccddef9a5471a8fc091e217a4734319481026e150d4bbd5be3e167525b084d726b0e5e74b975e4833e796c14adc26c0315b4447c5b56dfc5a6c12a0a9dbd01eac73af73902c0725dc175f78d9ef2e7c084f3f8f5d25977849fe5b5cad17cf886f1442a42bee8c31cf1f9a9b23e0c5e47a636b0189f3d5376f0e6aa4f4051abdcaf6c49c983fe4d095b3ed81769e3d19c08de2581bc2a455dce7ec9708ec4f8ff97bdb3cb59503b545764058baea7505b86bde7af283e53e59513abaad32c901764ba5147ee139ba33354"}, {@none, 0x89, 0x20, "0f0435", 0x6, 0x2, "c68f545b3eaec0e6fade00e66cb001fb9586e7ecd10c1884ca5a6b442adcffd3bf3493fec608537953800072b699942a5a55a9240647add8789802d2fb0cc824db3af19b4e88f68df00077a036e8cf052a9da8f0f0b761ea2611a034dbe9160f0a6441a03fbc509c6f87f27c3278a391ab79e17540a3a39de63bd164d46e04c1b0e394bc017206543bbaa004d3f4d1df4f5368ce5b308e4f415dd5cf3b9a53fedd5be3571c82dc315a11a2675bdb6e0421ab585d7084c0125d0f3524051beb85a703accad869e9a0c772de91609b25f558719cf562724a722c57866c26fdca452fc0605e8c590ead3829a73e682d5814"}, {@any, 0xac, 0x0, "eef29a", 0x0, 0x3d, "8821e7a55bccf9f72f97212683d3e81a1454ab1944f3e2c9057b411f78d8cfcad25ea71cf97496a2911eab38ce6435c3961a503c659ceaa3f2d41937cb4043d49404dfb16ed57ecaf5bf4a613f83bbe0ed73b8653f604e38fdd721832e9a47c7f96d1caceaf1e030ee86509a1ed9dfab75f64311b9ab32f92d47b6d5561cb83006270fca7b0eb19f23424c60e68d12bf6be30f740aab983d9a75fdc55d9c9a5dce1f577a15341b840028d0d3fba3149219e2637db6e4b786b9c3ebd1b55724fb33bb1c932c5fb036fb825945d73465d0e49b9922621269abfd5d0ca71985806c3d0df9a2d7313677b09aa606707e5100"}, {@fixed={[], 0x10}, 0x1, 0x0, "226a84", 0x4, 0x0, "0edfcf55830a4cddc5abcdd056007932780ffc6032077e6d39cf8f3fd0956ed8ec524c17bc0346b0e84b460159733af897d37dc24c9e1d10a4ec9ffe5a959e1242c4c5ab4cd66437a6c145f6c56aa7b1f98c3d309acc9363dad6f543632e458d01c095006bf253e7881a7bf5738203b1bda41b8a51ad04f53910dab1910e547f8f1d9dba7b8651d60c11518a833502af2344fa9a1c4ccc18848c0dcfc1dd3b9d8a6ff4e99c2697b779cc617e758489d3bc850163f2b61b5b27c7ac8299ebe0fc9ec271cfe600b40aef5439942a9c332b142ae964c0e739e698b00b847569d889bfe92afde9d39dd28c08ab281bd7ae70"}, {@none, 0x8, 0x6, "57f4bf", 0x400, 0x7f, "87e95952fbac0a7772da8ff0fc91b75e058b86bc358ad946e69a91e4fc6e11a211275d74a63900a4a34bcc66acef4b0e356737febd31a8afc7927ceca9d2751dc0fae82092a54405fc58cc4519dee07efc5d13d0301363d10fa5fa4fcd122d00a4351eb90a960d837192c0e9e02b36181e01f90ab874f5a0d80e71db1af465a3585e408c7339467c11206d50d4466323766888835be95549a33908baa81788d7a8b93759e5cacc151d0813ea3a5e20f98017ce3fac95ebe46211fd1ec93bc9f2070c683d80808623f756503bc7a6ea08173b893494fcfd82aee45d0ea81fd237f7e03aff5f186ed4c6a360044e3caef0"}, {@none, 0x4, 0x96, "dbee47", 0x2, 0x1, "2f42210cbc65645708d47f81a8767dfdf46cff2e5eed6b018ae08ca102624e6fedb7939b4f532ba1a2147db02110d5d63e41ef8aa1824ddc5818d61ae19b5af7ec2ca0c93da39cf221cba7259d9c195812f60b5a73033791d00ade343920628006edf68135760dddbd6cbdd9c14254652fb0f17fbc5656920644c5ad6f35b09378e51c23ebd8499e7d22d36663163eee151c02a6b91d277db8247a2e4b1dd65d16d8684f37c4d71db39e3884095dbd62d1b6253258905a9ae01e72ebaeafd88f498125a923b906d15c3008a7dabefca9992b5c352451e0c915073af12ccf865b6fc267d4239b85af254d9204df7ad2c6"}]}}}, 0x9f0)

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x38fe)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
accept$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:07 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340))

04:39:07 executing program 1:
socketpair(0xf, 0x0, 0x0, &(0x7f0000000000))

04:39:07 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, &(0x7f0000000000)={0x5, 0x3, 0x1, {0x69, 0x1f, 0x9, 0x1}})

04:39:07 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:07 executing program 3:
socketpair(0x29, 0x800, 0x3, &(0x7f0000000340))

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x38fe)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
accept$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:07 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
shmat(0xffffffffffffffff, &(0x7f0000ffe000/0x2000)=nil, 0x3000)

04:39:07 executing program 1:
socketpair(0xf, 0x0, 0x0, 0x0)

04:39:07 executing program 2:
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/mdstat\x00', 0x0, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000040}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0, @ANYRES16=0x0, @ANYBLOB="100025bd7000fedbdf25050000000800110001000000050001000000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0xc0)
r2 = geteuid()
setuid(r2)
sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, 0x0, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40015}, 0x5)

04:39:07 executing program 4:
r0 = shmget(0x3, 0x2000, 0x54000000, &(0x7f0000ffe000/0x2000)=nil)
shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000)
r1 = socket$inet(0x2, 0xa, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x1dd3}, @L2TP_ATTR_SEND_SEQ={0x5}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xfff}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x44008881}, 0x20000004)
getsockname$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @broadcast}, &(0x7f0000000040)=0x10)
sendmsg$L2TP_CMD_NOOP(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="448ffb00", @ANYRES16=0x0, @ANYBLOB="080025bd7000fddbdf2500000000050014007f00000006001c000200000014002000fe8000000000000000000000000000bb0c000f000010000000000000"], 0x44}}, 0x10)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:07 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x38fe)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:07 executing program 3:
socketpair(0x0, 0x800, 0x3, &(0x7f0000000340))

04:39:07 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000040)={{{@in, @in=@private}}, {{@in6=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000140)=0xe8)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:07 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x38fe)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000200)='/dev/vcsa#\x00', 0x8f1, 0x105040)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x19})
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x6, 0x1, 0x1, @loopback, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8040, 0x700, 0x80000000, 0x4}})
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x800, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3f}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x802}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000081}, 0x20000004)

04:39:08 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1)
ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, &(0x7f0000000040)={0x1, 0x0, 0x102, 0x6, {0x200, 0x1, 0x8001, 0x3}})
syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="0206000000000000000f010400f91a01000601040005000900033f0700400001073f040002000100068004001a55f9ff0c080500070008003f043f04000100ff070000000000aa83fc4ac1a2ffb469d90754b0b97be9cd"], 0x46)

04:39:08 executing program 3:
socketpair(0x0, 0x800, 0x3, &(0x7f0000000340))

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:08 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x1000})
r0 = semget$private(0x0, 0x4, 0x8)
semctl$SEM_INFO(r0, 0x1, 0x13, &(0x7f0000000040)=""/44)
r1 = fork()
syz_open_procfs$namespace(r1, 0x0)
syz_open_procfs$namespace(r1, &(0x7f00000000c0)='ns/time\x00')

[  838.679496] Bluetooth: hci2 ACL packet for unknown connection handle 6
04:39:08 executing program 5:
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0x15, 0x1, 0x4, &(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x3c, r3, 0x2, 0x70bd2b, 0x25dfdbf7, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004810}, 0x40084)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x8, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x80)
r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r5, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_DBG_S_REGISTER(r5, 0x4038564f, &(0x7f00000003c0)={{0x3, @name="683a2944511b28767968f32d4106608f217b18154bdda531804029e6e19831a6"}, 0x8, 0x6795, 0x8})
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0)='l2tp\x00')
sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, 0x0, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x44000)
sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r6, 0x800, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004010}, 0x4084000)

04:39:08 executing program 3:
socketpair(0x0, 0x800, 0x3, &(0x7f0000000340))

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x6, 0x281)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:08 executing program 5:
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 3:
socketpair(0x29, 0x0, 0x3, &(0x7f0000000340))

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
ioctl$NS_GET_NSTYPE(r0, 0xb703, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 4:
r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_DBG_G_REGISTER(r0, 0xc0385650, &(0x7f0000000040)={{0x3, @addr=0xaa1}, 0x8, 0x400, 0x5})
r1 = socket$inet(0x2, 0xa, 0x0)
syz_init_net_socket$nfc_raw(0x27, 0x0, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:08 executing program 2:
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000}, &(0x7f0000000080)=0x10)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:08 executing program 5:
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x2010, r0, 0xbf000)

04:39:08 executing program 3:
socketpair(0x29, 0x0, 0x0, &(0x7f0000000340))

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f0000000040)={0x0, 0x100, "51795770f6c78497db6ec8425320c29549395400", 0x54c, 0x0, 0x4, 0xf4b5, 0x7fff, 0xfffffffa, 0x200, 0x767, [0x1, 0x1, 0xc5e12a21, 0x3]})

04:39:08 executing program 4:
r0 = socket$inet(0x2, 0x2, 0x6)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/consoles\x00', 0x0, 0x0)
sendto$l2tp(r1, &(0x7f0000000040)="7ec4bcdf4bd475b63f0571a77eac7e7f65c41cd9b4931456c2672a44044ec51240f0b4880d6453efa83a70f1849c071fff7676edfc8a8fadba432acc765f", 0x3e, 0x4, &(0x7f0000000080)={0x2, 0x0, @rand_addr=0x64010100, 0xffffffff}, 0x10)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r4, 0x83b, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040084}, 0x8090)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:08 executing program 3:
socketpair(0x29, 0x0, 0x0, 0x0)

04:39:08 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x38fe)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x6, 0x0, 0x2023, 0x1000, 0x1ff, 0x8, 0x1})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/net\x00')
ioctl$NS_GET_NSTYPE(r0, 0xb703, 0x0)
ioctl$NS_GET_USERNS(r0, 0xb701, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x800, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000200)='/dev/vcsa#\x00', 0x8f, 0x8000)
ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f0000000240))
mmap$fb(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000, 0x10, r1, 0x5e000)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000080)=""/250, 0xfa, 0x10000, &(0x7f00000001c0)={0x2, 0x0, @initdev}, 0x10)
r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
ioctl$NS_GET_NSTYPE(r3, 0xb703, 0x0)
ioctl$NS_GET_USERNS(r3, 0xb701, 0x0)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x2000)
mmap$fb(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0xe000)

04:39:08 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socketpair(0x15, 0x1, 0x4, &(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x3c, r3, 0x2, 0x70bd2b, 0x25dfdbf7, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004810}, 0x40084)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x8, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x80)
r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r5, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_DBG_S_REGISTER(r5, 0x4038564f, &(0x7f00000003c0)={{0x3, @name="683a2944511b28767968f32d4106608f217b18154bdda531804029e6e19831a6"}, 0x8, 0x6795, 0x8})
r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0)='l2tp\x00')
sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, 0x0, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_I_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x44000)
sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r6, 0x800, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004010}, 0x4084000)

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x38fe)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x2f, 0x7f, 0x1, 0x7fff, 0x21, @private2={0xfc, 0x2, [], 0x1}, @ipv4={[], [], @multicast2}, 0x748, 0x40, 0x20, 0x1}})
shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0xc000)
mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1)
mlock2(&(0x7f0000ff9000/0x7000)=nil, 0x7000, 0x1)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:08 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x80}, 0x2)

04:39:08 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
socket$inet(0x2, 0x5, 0x99df9df)

04:39:08 executing program 3:
socketpair(0x0, 0x800, 0x3, &(0x7f0000000340))

04:39:08 executing program 5:
r0 = socket$inet(0x2, 0x0, 0x38fe)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 1:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 2:
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl0\x00', <r0=>0x0, 0x4, 0x7, 0x6, 0x3d, 0x20, @private2={0xfc, 0x2, [], 0x1}, @mcast1, 0x10, 0x8, 0x0, 0xf6f7}})
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000640)='/proc/partitions\x00', 0x0, 0x0)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000740)={@ipv4, <r2=>0x0}, &(0x7f0000000780)=0x14)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000840)={'syztnl1\x00', &(0x7f00000007c0)={'ip6tnl0\x00', r2, 0x2f, 0x1, 0xe0, 0xffffff2d, 0x3, @private1={0xfc, 0x1, [], 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1, 0x40, 0x9, 0x1}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl2\x00', r0, 0x29, 0x7, 0x5, 0x8, 0x20, @mcast2, @local, 0x1, 0x8, 0x3, 0xa}})

04:39:08 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x40db62a7d355b9e)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000080)={0x9e0000, 0x1, 0x8, r0, 0x0, &(0x7f0000000040)={0x9a0907, 0xc95f, [], @value=0x5}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:08 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0xe000, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x30, r0, 0x0)

04:39:08 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:08 executing program 1:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:08 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x24}}, 0x4040)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, r3, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8b}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xfb}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x8000090)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 5:
socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:09 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0xe000, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x30, r0, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x40c1)
mmap$perf(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x2000000, 0x2010, r1, 0x2)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
shmget$private(0x0, 0x3000, 0x8, &(0x7f0000ffb000/0x3000)=nil)

04:39:09 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x3, 0x84180)
socket$nl_generic(0x10, 0x3, 0x10)

04:39:09 executing program 1:
socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:09 executing program 5:
socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:09 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0xe000, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x30, r0, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x7, 0x46, @empty, @mcast1, 0x700, 0x8000, 0x2}})
ioctl$VIDIOC_S_MODULATOR(r0, 0x40445637, &(0x7f00000007c0)={0x0, "b3a34133e75a3fe78cb14c340a0ff33f7e3f7374ce1e539428177ebfc77314bd", 0x2, 0x0, 0x0, 0x10})
ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_ENUM_FREQ_BANDS(r2, 0xc0405665, &(0x7f00000000c0)={0xcbc, 0x5, 0x4, 0x0, 0x80000001, 0x0, 0x2})
recvmsg$can_bcm(r1, &(0x7f0000000540)={&(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000280)=""/242, 0xf2}, {&(0x7f00000001c0)=""/181, 0xb5}, {&(0x7f00000006c0)=""/243, 0xf3}, {&(0x7f0000000380)=""/253, 0xfd}], 0x4, &(0x7f00000004c0)=""/110, 0x6e}, 0x102)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:09 executing program 1:
socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:09 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)=@nfc, 0x80, &(0x7f0000000400)=[{&(0x7f0000000080)=""/6, 0x6}, {&(0x7f00000000c0)=""/155, 0x9b}, {&(0x7f0000000180)=""/2, 0x2}, {&(0x7f00000001c0)=""/111, 0x6f}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/71, 0x47}, {&(0x7f0000000300)=""/38, 0x26}, {&(0x7f0000000340)=""/49, 0x31}, {&(0x7f0000000380)=""/101, 0x65}], 0x9, &(0x7f00000004c0)=""/12, 0xc}, 0x4000)

04:39:09 executing program 2:
clock_gettime(0x7, &(0x7f0000000040))
clock_getres(0x7, &(0x7f00000000c0))
syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x3, 0x2)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:09 executing program 5:
socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="f2122e80975098f680337097d9c35493336355db76f6c6311e44a046084ce6523e3cd4d9f9400006ae6ea3cfebe47707f21cd4fcc062f1ae8651f9ee989b20283f70c8854ffe9787ce9e40bbce3610ff65e808c61e7ef21ca419baa52b25c47e87a6a7a5487bcc6527d1873f558a2828d49d1030a1c17e80cb236ca7e11b83a7169c874e204b665e480b0f40426c177821e28c285f7e788c05", 0x99, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:09 executing program 3:
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0xe000, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8, 0x2)
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4)
socket$inet6_udp(0xa, 0x2, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f00000001c0)={&(0x7f0000ff4000/0x2000)=nil, 0x2000})
r2 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x7, 0x2700)
sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2c0000004e081edb934773403e31b79b5c3d2e494ff80b5a6f9a21dca2524d56d67f62ffe35d00d0583437b5c4d96810ebd3c70fe2cf50434616ee96b85ba79a1921dbbde22a8ba3807654563a6a40c3878b2938ce87c11aa346f72bb49f77c5cd1d3a342f8a64138d284cee1ab0e89e2ca9", @ANYRES16=0x0, @ANYBLOB="00012bbd7000fedbdf25050000000600030018710000060002000000000008000c0004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x24008004)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', <r3=>0x0})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000580)={0xaa, 0x2})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f00000002c0)={'ip6_vti0\x00', r3, 0x4, 0x6, 0x22, 0x9365, 0x36, @private0={0xfc, 0x0, [], 0x1}, @rand_addr=' \x01\x00', 0x40, 0x7, 0x3, 0x27}})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000380)={{{@in=@remote, @in6=@mcast1}}, {{@in=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000000480)=0xe8)

04:39:09 executing program 1:
socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})

04:39:09 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', <r1=>0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl0\x00', r1, 0x2170c6e63df5d7c1, 0xf8, 0x95, 0x6, 0x28, @rand_addr=' \x01\x00', @local, 0x8, 0x10, 0x1, 0x7}})

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0xe000, 0x0)

04:39:09 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x10, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:09 executing program 2:
socket$inet6(0xa, 0x1, 0x1f)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000040)={@remote}, &(0x7f0000000080)=0x14)
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f00000000c0)=@generic, 0x80, &(0x7f0000001480)=[{&(0x7f0000000140)=""/103, 0x67}, {&(0x7f00000001c0)=""/191, 0xbf}, {&(0x7f0000000280)=""/198, 0xc6}, {&(0x7f0000000380)=""/72, 0x48}, {&(0x7f0000000400)=""/122, 0x7a}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x6, &(0x7f0000001500)=""/215, 0xd7}, 0x0)

04:39:09 executing program 1:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0)

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, 0x0, 0xe000, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x5b, 0x12c00)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:09 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010100, 0x2}, 0x10)

04:39:09 executing program 4:
ioctl$VIDIOC_TRY_ENCODER_CMD(0xffffffffffffffff, 0xc028564e, &(0x7f0000000000)={0x0, 0x1, [0x350a, 0x5, 0x3, 0x0, 0x3, 0xff, 0x6, 0x8]})
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x783}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x814)
ioctl$VIDIOC_SUBDEV_G_FMT(0xffffffffffffffff, 0xc0585604, &(0x7f0000000040)={0x1, 0x0, {0x7ff, 0x36c3, 0x2014, 0x4, 0x1, 0x4, 0x1, 0x3}})

04:39:09 executing program 1:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0)

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, 0x0, 0xe000, 0x0)

04:39:09 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0xf8000)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x6, 0xa003)
ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f00000000c0)=0x40)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/timers\x00', 0x0, 0x0)
r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r4, 0x40305652, &(0x7f0000000680)={0x0, 0x0, 0x400003, 0x0, 0x2, 0x7f})
ioctl$VIDIOC_DBG_S_REGISTER(r4, 0x4038564f, &(0x7f0000000140)={{0x1, @name="ca86c1c3763e6307e2b80c011816814c5337ce82d6e7f101b396a06b54fda3f1"}, 0x8, 0xc0000000000000, 0x4})
ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x3000, 0x1})

04:39:09 executing program 4:
r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2)
ioctl$VIDIOC_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000040)={0x6, 0x0, [], {0x0, @reserved}})
r1 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, 0x0, 0xe000, 0x0)

04:39:09 executing program 1:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0)

04:39:09 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x0, 0x6000)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000640)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00e825bd7000fbdbdf250700000008000c000000000008001700", @ANYRES32, @ANYBLOB], 0x24}}, 0x4040)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00')
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000126bd7000fddbdf250600000006000e000700691a778d283a65000000060002000000000057071800ac1414bb050014081f00000005002100010000000600020001000000"], 0x4c}, 0x1, 0x0, 0x0, 0x40040}, 0x20000040)

04:39:09 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000080)={0x9d0000, 0x80000001, 0x3ff, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x990a2d, 0x9, [], @value64=0x7ff}})
mmap$fb(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x0, 0x40010, r0, 0x0)

04:39:09 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x0, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x0, 0x600, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40001}, 0x4090)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000080)=<r2=>0x0, &(0x7f00000000c0)=0x4)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'ip6tnl0\x00', r2, 0x2f, 0x4, 0xfd, 0x9, 0x12, @private1, @remote, 0x700, 0x80, 0xffff, 0x5}})

04:39:09 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="041817ffffffffffffd870c8142e057ccaa8fda742e93365ca006a6b35799aed23a1109116b8c01243f82e88992ee939400e14c85aea67d6fe28101b2e3b9bd9a1c071596a964dd9e3ee3472267f8794d46553cd5824f5fe65b4c199c1bc9a564e62cc5ce6c9d1a6922b5f014df5ac6d934ea83c63ea7ca3f0631fcfe2228d2ec2dbf8093cd396bc1b98026eebf591"], 0x1a)

04:39:09 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$sock_SIOCDELRT(r1, 0x890c, &(0x7f0000000040)={0x0, @hci={0x1f, 0x3, 0x1}, @l2={0x1f, 0x1000, @fixed={[], 0x12}, 0x40, 0x2}, @llc={0x1a, 0x30d, 0x79, 0x4, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x9bc6, &(0x7f0000000000)='vlan0\x00', 0xffffffffffffff7f, 0xe56c})

04:39:09 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x0, 0x0)

04:39:09 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:09 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_OUTPUT(r1, 0x8004562e, &(0x7f0000000080))

04:39:09 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x0, @rand_addr, 0x2}, 0x10)

04:39:09 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x480200)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ffc000/0x1000)=nil, 0x1000})
r1 = socket$inet(0x2, 0x3, 0x80000001)
getsockopt$inet_mreqn(r1, 0x0, 0x23, 0x0, 0x0)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000100)={@empty}, &(0x7f0000000140)=0xc)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f00000000c0)=0x10)

04:39:09 executing program 2:
syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="03c800000175817d2cb3f233d510ff710f6f74bc370c3e922586ab9abee0fa39ea565d12e371a882e3925bc94b6c6d763eaff12bb1245d319a0a07563355ba0692c33011f0a638678fe70eeef3b09678ad189ed2b8ac9f38a99d93a020"], 0x2f)
ioctl$VIDIOC_S_MODULATOR(0xffffffffffffffff, 0x40445637, &(0x7f0000000000)={0x6, "5f193ca4af876014eee35978202380c81f6288213439308355dfe164f0485e10", 0x1, 0x1, 0xffffffe1, 0x10, 0x3})

04:39:09 executing program 3:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x0, 0x0)

04:39:10 executing program 1:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:10 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x3, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_conn_param_update_rsp={{0x13, 0x0, 0x2}}}}, 0xf)

04:39:10 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000040)='/dev/video#\x00', 0x4, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000000c0)={0x7, 0x1, 0x4, 0x100000, 0x5, {}, {0x4, 0x2, 0x3, 0x7f, 0x4, 0x5, "ecf65773"}, 0x7, 0x1, @fd, 0x5, 0x0, <r1=>0xffffffffffffffff})
syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x9, 0x2, 0x4, 0x800, 0x40, {0x77359400}, {0x5, 0x8, 0x6b, 0x73, 0x6, 0xff, "4d01d63a"}, 0x6, 0x2, @planes=&(0x7f00000003c0)={0x0, 0x2, @mem_offset=0x4d8}, 0x1b, 0x0, r1})
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r3 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, r3, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_TID={0xc, 0x3, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x51)
socketpair(0x1, 0xa, 0x7, &(0x7f00000001c0))
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r2, 0x0)
ioctl$VIDIOC_S_MODULATOR(r2, 0x40445637, &(0x7f0000000200)={0x101, "e82e2a3694303a706287d1ce52cc1e1fc0e248891069669e516c67b1ba51ee08", 0x400, 0x81, 0x2, 0x4, 0x4})
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff3000/0x2000)=nil, 0x2000, 0xb, 0x2010, r4, 0x56000)

04:39:10 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', <r1=>0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl0\x00', r1, 0x2170c6e63df5d7c1, 0xf8, 0x95, 0x6, 0x28, @rand_addr=' \x01\x00', @local, 0x8, 0x10, 0x1, 0x7}})

04:39:10 executing program 5:
r0 = socket$inet(0x2, 0xa, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x10)

04:39:10 executing program 4:
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000000)={0xc, 0x5, 0x1, 0x0, r1})
socket$inet(0x2, 0xa, 0x0)

04:39:10 executing program 2:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x2})
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:10 executing program 1:
sendto$l2tp(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:10 executing program 5:
r0 = syz_open_dev$vim2m(&(0x7f0000000040)='/dev/video#\x00', 0x4, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000000c0)={0x7, 0x1, 0x4, 0x100000, 0x5, {}, {0x4, 0x2, 0x3, 0x7f, 0x4, 0x5, "ecf65773"}, 0x7, 0x1, @fd, 0x5, 0x0, <r1=>0xffffffffffffffff})
syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x9, 0x2, 0x4, 0x800, 0x40, {0x77359400}, {0x5, 0x8, 0x6b, 0x73, 0x6, 0xff, "4d01d63a"}, 0x6, 0x2, @planes=&(0x7f00000003c0)={0x0, 0x2, @mem_offset=0x4d8}, 0x1b, 0x0, r1})
r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r3 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, r3, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_TID={0xc, 0x3, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x51)
socketpair(0x1, 0xa, 0x7, &(0x7f00000001c0))
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r2, 0x0)
ioctl$VIDIOC_S_MODULATOR(r2, 0x40445637, &(0x7f0000000200)={0x101, "e82e2a3694303a706287d1ce52cc1e1fc0e248891069669e516c67b1ba51ee08", 0x400, 0x81, 0x2, 0x4, 0x4})
r4 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r4, 0x0, 0x4040)
mmap$fb(&(0x7f0000ff3000/0x2000)=nil, 0x2000, 0xb, 0x2010, r4, 0x56000)

04:39:10 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x2012, r0, 0x15000)
r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xf6, 0x40002)
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_G_EDID(r2, 0xc0285628, &(0x7f0000000240)={0x0, 0x4, 0x400, [], &(0x7f0000000100)=0xff})
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}})
sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000226bd7000fbdbdf250200000006001a004e2200000c001600940a0000000000ee0b00160001000080000c000000000071fd1a004e20000008000900030000001400200000000000000000000000ffff000000000000000000dbd26cd09804d9e0e0db72e593ce2d32"], 0x60}, 0x1, 0x0, 0x0, 0x20488d0}, 0x20008801)

04:39:10 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', <r1=>0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl0\x00', r1, 0x2170c6e63df5d7c1, 0xf8, 0x95, 0x6, 0x28, @rand_addr=' \x01\x00', @local, 0x8, 0x10, 0x1, 0x7}})

04:39:10 executing program 4:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)
r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_SUBDEV_S_EDID(r2, 0xc0285629, &(0x7f0000000340)={0x0, 0x3, 0x2462ce91, [], &(0x7f0000000300)=0x1})
r3 = syz_genetlink_get_family_id$gtp(&(0x7f00000001c0)='gtp\x00')
sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4c010}, 0x8040)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'})
r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x4, 0x10000)
r5 = syz_open_dev$swradio(&(0x7f0000000380)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f00000003c0)={0x1, "7aa9c9069782059ecae82581235665c6e6863c6d92cf4b0274666c0d5a6d9742", 0x4, 0x20, 0x5, 0x7f, 0x1, 0x3, 0x5, 0x10000})
connect$l2tp(r4, &(0x7f0000000140)={0x2, 0x0, @local, 0x2}, 0x10)
syslog(0x1, &(0x7f0000000040)=""/139, 0x8b)

04:39:10 executing program 1:
sendto$l2tp(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:10 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000040)={0x0, 0x3, 0x60, 0x32, 0xfffffff7, 0x81, 0x7f})
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)

04:39:10 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
socketpair(0x3b, 0x4, 0xd94, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000002200010029bd7000fddbdf250a20201f06000007020001006dc630aa8cd7ec68cb6522a7c85dfd79abdf54c621ca42234610ae28a32e52dea8e04ee97230240e5cfc7e5c978d6999c871e5e9ed964406e559c8057072e1b5c56b72535370dcd4cbaf59b1b74782daa57ba1429d21012a3189dfb45d43f5c709d64ff06a1c724e8072012277accfc4caf0025fe1762c06da5ed182faa08cdc1c72805a196553fc88ff07"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0)

04:39:10 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x2})
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:10 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', <r1=>0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl0\x00', r1, 0x2170c6e63df5d7c1, 0xf8, 0x95, 0x6, 0x28, @rand_addr=' \x01\x00', @local, 0x8, 0x10, 0x1, 0x7}})

04:39:10 executing program 1:
sendto$l2tp(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:10 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x2})
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:10 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x13db68f7a1de501)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000040)={0xff, 0x0, 0x201e, 0x6, 0x8, 0xd7b, 0x1, 0x1})
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f00000000c0)=0x10)

04:39:10 executing program 2:
r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000680))
ioctl$VIDIOC_TRY_ENCODER_CMD(r0, 0xc028564e, &(0x7f0000000040)={0x3, 0x0, [0x6, 0xbaa, 0x57d0, 0xc2, 0x400, 0x0, 0x40, 0x3]})
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000128bd7000fe000000004f1000020000000c000f0000010000000000003f5c3e1477f2849665ab0b6dcc1b0439c5cb43e86e37de31b36a14e9ad70f414a346216d2646c9a27af34a2103b7085f569c421ecc0e49398bfe6f926976fdfbd28137c5590388701180ea8db8cf8f65d16d32900c5cd17837188e3e310cb1bb97cb0ab5409e890d631075176f1b4603f9a0840594e386bdae451d885cfe1b0b06dee549d21bcb682f885325794ffe9a1055859b5d8873a8df60"], 0x34}, 0x1, 0x0, 0x0, 0x640288c5}, 0x20040000)

04:39:10 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', 0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, 0x0, 0x4040)

04:39:10 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:10 executing program 4:
socket$inet(0x2, 0x80000, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x8696fc7c38059de3, 0x0, 0x0)

04:39:10 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x2})
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT, 0x2)

04:39:10 executing program 2:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_disconn_logical_link_complete={{0x46, 0x2}, {0x3, 0xc8, 0xa}}}, 0x7)

04:39:10 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', 0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)
syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)

04:39:10 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x0, 0x40010, r0, 0x0)
r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, &(0x7f0000000180)={0x6, 0x4, 0x401, 0x8, 0xff, 0x80000000, 0x9})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, 0x0, 0x4040)
r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000640)='/dev/video2\x00', 0x2, 0x0)
ioctl$VIDIOC_S_HW_FREQ_SEEK(r3, 0x40305652, &(0x7f0000000680)={0x0, 0x4, 0x10, 0x1, 0x8, 0x0, 0xfffffffd})
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRES16=0x0, @ANYRES32=r0], 0x34}, 0x1, 0x0, 0x0, 0x24000814}, 0x10)

04:39:10 executing program 3:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6tnl0\x00', 0x0, 0x8ffa337394729486, 0x50, 0x0, 0x5, 0x40, @loopback, @mcast1, 0x20, 0x80, 0xff, 0x7}})
getitimer(0x26b4a50f7b18f1db, &(0x7f0000000180))
socket$l2tp(0x2, 0x2, 0x73)
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2)

04:39:10 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:39:10 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
mmap$fb(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x200000c, 0x40010, r0, 0x6c000)

04:39:10 executing program 2:
syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x2be}, @hci_ev_le_ext_adv_report={{}, {0x3, [{0x13, 0x1, @fixed={[], 0x10}, 0x5, 0x1, 0x40, 0xfc, 0xe9, 0x8, 0x1, @any, 0xf0, "8d09c6467325ce057c61238b4137d6eccde63db19f837757b7eed1849c63e29cdfb5a4fa1f81dd3e501d73d088d9a4e996dd50cf0a41b592365ac3776909dec78691e4136e55855c539d66f461880a7552af27191c8c971279175dc18fdfb94c6af9915d977befd356b9975422a4b7464bade54c628a9564012f051aac1b4fa13df0e6481b803a7d56c88c37f8e9a668158d62547f2702b7e938dadcb25205367bb6b1e1ce10284c9f5210028b85d322a5187abd2cee8c1b3230abd97b849fd6c22631d5c9883b92c0270aba6eabc0c06477634f369101ac01ff218bf75918577503c13f418987df0fb2aafd7f2bfc09"}, {0x15, 0x0, @fixed={[], 0x11}, 0x1, 0xc0, 0x1, 0x1f, 0x7f, 0x9, 0x5, @none, 0xfd, "0b5ae19a7eeda2bd9aedcc3a4d466dd970984ad7d83efaeb62ec2d92b45e729716888aa30e870302257e0c0fda8a6027e75b3855e6a70ca861bc85129415df8ecb8676821f5345a095a6ac82b881300001e72d63ad17942e791ca6cf96bd0a6b9e42041d6c83fd4f008204b2e4e99daf7cdb41b5a173dc45eeeef1dd6a5a0674b32eba8075e3bb64954849b2849c74f1207ce0f0cf9785df5462443aed16e2680b10a711a705db415600b91c792d913194e1caff388ed7a3e0c969c1fdd3b2ff3793c3ddaa855a65edd4cf846d0cb4fa33f101a4a5bdbb8fa07cb60646ebb68cc3527d8952db02fec9afe53534bcd489f7eb620c5245e55c2d05611d1a"}, {0x0, 0x0, @any, 0x0, 0x20, 0x1, 0x8, 0x0, 0x0, 0x8, @any, 0x87, "2a869537b1959a38c2939c90c94899a4db1556ec83b228920f41b48e4a5a003ffd694b04b01267e9581efe08e99ab5288ac1099ea3d089c0d14c43f4e4fe845d5b62cd17cde2084ce2e4f315e1626ed78a0e388603a4de644b2af322035e0a7b89efe4716336420e73cde0dc4cc22cc43885da560b45432198371a446b2bb7ecd99fef46e783b7"}]}}}}, 0x2c1)

04:39:10 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x5, 0x6000)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0x0, 0x4040)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x2})
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4)

04:39:10 executing program 2:
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x1, 0x20}, @l2cap_cid_le_signaling={{0x1c}, @l2cap_ecred_conn_req={{0x17, 0x0, 0x18}, {0x7fff, 0x0, 0x6, 0x3, [0x4, 0x101, 0x1, 0x7ff, 0x1ff, 0x6, 0x0, 0x104]}}}}, 0x25)
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_channel_selected={{0x41, 0x1}, {0xc8}}}, 0x4)

04:39:10 executing program 1:
r0 = socket$inet(0x2, 0x0, 0x0)
sendto$l2tp(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

[  841.401487] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[  841.409507] IP: amp_read_loc_assoc_final_data+0xe6/0x190
[  841.414947] PGD 83bb5067 P4D 83bb5067 PUD 84cc4067 PMD 0 
[  841.420484] Oops: 0002 [#1] PREEMPT SMP KASAN
[  841.424969] Modules linked in:
[  841.428162] CPU: 0 PID: 8005 Comm: kworker/u5:4 Not tainted 4.14.218-syzkaller #0
[  841.435770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  841.445298] Workqueue: hci2 hci_rx_work
[  841.449273] task: ffff8880b28fe340 task.stack: ffff88807a678000
[  841.455328] RIP: 0010:amp_read_loc_assoc_final_data+0xe6/0x190
[  841.461289] RSP: 0018:ffff88807a67fa08 EFLAGS: 00010246
[  841.466644] RAX: 0000000000000000 RBX: 1ffff1100f4cff41 RCX: 1ffff1101651fd83
[  841.473911] RDX: 1ffff11009973bbb RSI: ffff88809f26e4c0 RDI: ffff88804cb9ddd8
[  841.481173] RBP: ffff88809f26e4c0 R08: 0000000000000000 R09: 0000000000000002
[  841.488433] R10: 0000000000000000 R11: ffff8880b28fe340 R12: ffff88804cb9da40
[  841.495699] R13: 0000000000000000 R14: ffff88804cb9da40 R15: ffff88804cbc1b80
[  841.495705] FS:  0000000000000000(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
[  841.495709] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  841.495713] CR2: 0000000000000030 CR3: 0000000083bb4000 CR4: 00000000001406f0
[  841.495720] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  841.495724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  841.495726] Call Trace:
[  841.495739]  ? amp_read_loc_assoc+0x140/0x140
[  841.495748]  ? hci_chan_selected_evt+0x176/0x360
[  841.495758]  ? lock_acquire+0x170/0x3f0
[  841.495764]  ? lock_downgrade+0x740/0x740
[  841.495778]  hci_chan_selected_evt+0x1b2/0x360
[  841.563321]  hci_event_packet+0x2260/0x7510
[  841.567636]  ? trace_hardirqs_on+0x10/0x10
[  841.571846]  ? hci_cmd_complete_evt+0xb490/0xb490
[  841.576666]  ? trace_hardirqs_on+0x10/0x10
[  841.580909]  ? debug_object_deactivate+0x1da/0x2e0
[  841.585819]  ? skb_dequeue+0x125/0x180
[  841.589684]  ? mark_held_locks+0xa6/0xf0
[  841.593744]  ? _raw_spin_unlock_irqrestore+0x79/0xe0
[  841.598840]  ? trace_hardirqs_on_caller+0x3a8/0x580
[  841.603847]  ? _raw_spin_unlock_irqrestore+0x66/0xe0
[  841.609026]  hci_rx_work+0x427/0xb40
[  841.612718]  ? rcu_lockdep_current_cpu_online+0xed/0x140
[  841.618163]  process_one_work+0x793/0x14a0
[  841.622376]  ? work_busy+0x320/0x320
[  841.626065]  ? worker_thread+0x158/0xff0
[  841.630102]  ? _raw_spin_unlock_irq+0x24/0x80
[  841.634581]  worker_thread+0x5cc/0xff0
[  841.638463]  ? rescuer_thread+0xc80/0xc80
[  841.642589]  kthread+0x30d/0x420
[  841.645946]  ? kthread_create_on_node+0xd0/0xd0
[  841.650592]  ret_from_fork+0x24/0x30
[  841.654290] Code: 44 24 21 48 b8 00 00 00 00 00 fc ff df 0f b6 04 02 84 c0 74 08 3c 01 0f 8e 90 00 00 00 41 0f b7 84 24 98 03 00 00 66 89 44 24 23 <f0> 41 80 4d 30 04 48 8d 6c 24 40 4c 89 e6 48 89 ef e8 14 6c fe 
[  841.673455] RIP: amp_read_loc_assoc_final_data+0xe6/0x190 RSP: ffff88807a67fa08
[  841.680894] CR2: 0000000000000030
[  841.684338] ---[ end trace a66b4cdd363bbb73 ]---
[  841.689065] Kernel panic - not syncing: Fatal exception
[  841.695071] Kernel Offset: disabled
[  841.698691] Rebooting in 86400 seconds..