0)='nl80211\x00') sendmsg$NL80211_CMD_SET_WIPHY(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="6d4a95d39f30fe43db204b0a3a0e511f0badd8948c9cff6cb231f462a74a7edc6f0974835c75e539a103abfc72218d5460e8c4c0d5d58bc27ea5b90b6aad39eccb6ea25509773d58cb156e5996508ffab5a441860fe898ab5822f0b50b234f0915f041c25b0685271ce77148c66a544a03b7c8d6e195aa3e4cb37c07408e1bd705a66571fdf566475771dab4ef3794027ccde9469d2f1ed30a71571e666c9591964b0890b195987f75df", @ANYRES16=r7, @ANYBLOB="000228bd7000fcdbdf25020000001400020076657468305f746f5f626f6e6400000008000c01000000000800610000020000"], 0x38}, 0x1, 0x0, 0x0, 0x40080b0}, 0x20010) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r3, 0xae03, 0x1) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000380)={0x0, 0x1b}, 0x8) 21:55:17 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x8, 0x1836a2) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r2, 0xc01064bd, &(0x7f00000002c0)={&(0x7f00000001c0)="0270ac6a5eb5c00a8a23bf0859795395969c29c980cc6fbc2634f2f2bba75a25789cf9b4024e9b64372b75071f5a1d4274d78b82cf19b2725d181daaeb2117caf8ad4ebaeecca8aae4eeeffdd30f49a79aded1eeb0b288891da7c43aca2b03f95846d28dc15f4557b56a61e9d21a6f7ce4844066f988d20b4f15a97c49ebaa2f6d6a15accec42817d886c6a66400643b089bb6f19162bb5c94ad514328211255be977ee1edf518e089db418722d13dccee25ba90453c650e09330954328252617a69fd610481a3d4fdf3ba6bc9a672c7cfd92997bcd02140d9033830cc6a2acd497cb07d2c3614746951", 0xea, 0x2}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r1, 0xc01064bd, &(0x7f0000000300)={&(0x7f00000000c0)="b4719d0ed4289e7a4c7fd653e7e1c389db21993f14899d579ec581e89a66c529b12b1997091f0dca03f5a824f63fb06a9230db075b05cd1a94c1f911816446deb5bb0abc63514d6c51f342641e4a2d37296f34c1500f6441e4e6b7aa29eb898d75beff26754c9ac2548c8379993a08cb1bfa7ac5eb823d7b2b3e2c313cd91db9f13e9b48a816e6e36031745f1588e80661f81fabb5f8483d2b15090f603dc440326bf8a925af5389a7763214ebb1117ecd651651abf3b6bd33ab24a9937d050d89cdf16323bdf8843f94f0f10019cbcf5eed53caae4a049910fc92252c3714", 0xdf, r3}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:17 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0x1, 0x6, 0x0, @buffer={0x0, 0x83, &(0x7f00000000c0)=""/131}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2421.025594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2421.032863] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:17 executing program 1 (fault-call:1 fault-nth:6): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:17 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffd, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x400202, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r1, 0xc0485661, &(0x7f0000000280)={0x0, 0x2, @start={0x0, 0xe451536c9ce2baea}}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x2, {0x40, 0x2}}}, 0xa0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) ioctl$LOOP_CLR_FD(r2, 0x4c01) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RXATTRCREATE(r3, &(0x7f0000000180)={0x7, 0x21, 0x2}, 0x7) r4 = dup2(0xffffffffffffffff, r0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000200)={r5}) 21:55:17 executing program 4: r0 = shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x1000004001) shmctl$IPC_RMID(r0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f00000000c0)=0x7, 0x4) r2 = shmat(r0, &(0x7f0000ffc000/0x1000)=nil, 0x5000) shmdt(r2) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$USBDEVFS_DISCSIGNAL(r3, 0x8010550e, &(0x7f00000001c0)={0x7, &(0x7f0000000180)}) shmdt(r2) r4 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000180)) [ 2421.190186] FAULT_INJECTION: forcing a failure. [ 2421.190186] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2421.213612] CPU: 0 PID: 13506 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2421.221528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2421.230885] Call Trace: [ 2421.233493] dump_stack+0x13e/0x194 [ 2421.237132] should_fail.cold+0x10a/0x14b [ 2421.241290] __alloc_pages_nodemask+0x1bf/0x700 [ 2421.245967] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2421.250999] alloc_pages_current+0xe7/0x1e0 [ 2421.255329] sg_build_indirect.isra.0+0x377/0x950 [ 2421.260189] sg_common_write.isra.0+0x8be/0x1e20 [ 2421.264966] ? sg_open+0x1490/0x1490 [ 2421.268682] ? find_held_lock+0x2d/0x110 [ 2421.272757] ? cap_capable+0x1c4/0x230 [ 2421.276658] ? security_capable+0x88/0xb0 [ 2421.280807] ? ns_capable_common+0x127/0x150 [ 2421.285211] sg_new_write.isra.0+0x581/0x8c0 [ 2421.289793] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2421.294802] ? scsi_block_when_processing_errors+0x268/0x340 [ 2421.300580] ? scsi_ioctl_reset+0x740/0x740 [ 2421.304886] ? __lock_acquire+0x5f7/0x4620 [ 2421.309114] ? lock_downgrade+0x6e0/0x6e0 [ 2421.313258] sg_ioctl+0x1040/0x2620 [ 2421.316870] ? check_preemption_disabled+0x35/0x240 [ 2421.321867] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2421.326441] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2421.331006] do_vfs_ioctl+0x75a/0xfe0 [ 2421.334790] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2421.339530] ? ioctl_preallocate+0x1a0/0x1a0 [ 2421.343927] ? security_file_ioctl+0x76/0xb0 [ 2421.348317] ? security_file_ioctl+0x83/0xb0 [ 2421.352710] SyS_ioctl+0x7f/0xb0 [ 2421.356059] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2421.360023] do_syscall_64+0x1d5/0x640 [ 2421.363907] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2421.369078] RIP: 0033:0x45c829 [ 2421.372259] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2421.379978] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 21:55:17 executing program 5: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) io_setup(0x1, &(0x7f0000000300)=0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r1, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) [ 2421.387228] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2421.394478] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2421.401734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2421.408993] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:17 executing program 1 (fault-call:1 fault-nth:7): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2421.536747] FAULT_INJECTION: forcing a failure. [ 2421.536747] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2421.575574] CPU: 0 PID: 13533 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2421.583496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2421.592852] Call Trace: [ 2421.595450] dump_stack+0x13e/0x194 [ 2421.599102] should_fail.cold+0x10a/0x14b [ 2421.603264] __alloc_pages_nodemask+0x1bf/0x700 [ 2421.607944] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2421.612979] alloc_pages_current+0xe7/0x1e0 [ 2421.617312] sg_build_indirect.isra.0+0x377/0x950 [ 2421.622175] sg_common_write.isra.0+0x8be/0x1e20 [ 2421.626949] ? sg_open+0x1490/0x1490 [ 2421.630669] ? find_held_lock+0x2d/0x110 [ 2421.634735] ? cap_capable+0x1c4/0x230 [ 2421.638636] ? security_capable+0x88/0xb0 [ 2421.642789] ? ns_capable_common+0x127/0x150 [ 2421.647203] sg_new_write.isra.0+0x581/0x8c0 [ 2421.651624] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2421.656667] ? scsi_block_when_processing_errors+0x268/0x340 [ 2421.662464] ? scsi_ioctl_reset+0x740/0x740 [ 2421.666788] ? __lock_acquire+0x5f7/0x4620 [ 2421.671030] ? lock_downgrade+0x6e0/0x6e0 [ 2421.675188] sg_ioctl+0x1040/0x2620 [ 2421.678816] ? check_preemption_disabled+0x35/0x240 [ 2421.683834] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2421.688427] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2421.693014] do_vfs_ioctl+0x75a/0xfe0 [ 2421.696817] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2421.701580] ? ioctl_preallocate+0x1a0/0x1a0 [ 2421.706002] ? security_file_ioctl+0x76/0xb0 [ 2421.710412] ? security_file_ioctl+0x83/0xb0 [ 2421.714822] SyS_ioctl+0x7f/0xb0 [ 2421.718191] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2421.722169] do_syscall_64+0x1d5/0x640 [ 2421.726065] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2421.731257] RIP: 0033:0x45c829 [ 2421.734448] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2421.742160] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2421.749424] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2421.756691] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2421.763956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2421.771226] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:18 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000100)={0x9, "e29e6bbf6d6f12e69bfdf001f6340e6bb270fce25519355f2d2e2e2b0fbcd1c4ba8b66acc6c9c97063bd972897832ccb829c8f4334fc3e46787758538e428f4ccff77cdc1e38c6293617be7cda0f88d7bde374de5ead5f31d1dbbd5a6364ef3be339f4e8dcde15b9d8cf6fbf19ccaee642743b532cba2a44f31c1e4b45f102cc88241dda1bcafe442bbef38649ec0b90e637f9ce8a1334043338a63ee6294b7b95f48c6c47b075d13ed9cbf4c78dffd6914d8665f5a22205e2b3a8e3137600744e6a70eaee4d2e2de05b97eb4c3918a8f916968f3d3362e38eb72ee382a821551aa026a92c9af979c6bbcce531c1ce72764c1118ccdc326ab55612b631fd879da2fd4c244b7f1e44066e5d6cdc3cd224fa3c53ee72e258718751ed666fb951d750e02d1f4b7e745445d529b9ca41a458eeaa43ffc407c5756edd36256d71b01de4b25767e21803e8ba8b6eb6bbb44cacaf48a72d52bd8e5c6d623a453239a23901487db9903d89c80978a0ce04cc4ff64039c48fb4470c0c7c209d72204c860ced8cbfb8c4fa4d2f2fc25fa8e12726cbe2c0267537f3b0298f3a124c4c901b205c7056b259c29a9a623f3b93e5472516791f4ebb4c2e602dbe0928fd07b7b6d67e8bd579e33c9bc059950580a12d0d780a151d8c00409a561a375b93f1ff0f6d30634dd8aab7bf46822f9a17c297be04bafaa56b58125a84f57f386f7e2ceabc"}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r1, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @bcast, @rose, @rose, @null]}, 0x48) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x60200, 0x0) ioctl$TCGETX(r2, 0x5432, &(0x7f0000000040)) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TIOCSCTTY(r3, 0x540e, 0x8) bind$netrom(r1, 0x0, 0x0) 21:55:18 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) 21:55:18 executing program 5: creat(&(0x7f0000000240)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:18 executing program 1 (fault-call:1 fault-nth:8): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:18 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x80, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xa0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$IMGETVERSION(r0, 0x80044942, &(0x7f00000001c0)) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000100)={0x1, 0x6, 0x4, 0x4000, 0x6, {}, {0x4, 0x2, 0x38, 0x6, 0x6f, 0x1, "c4b4d123"}, 0x5, 0x1, @offset=0x2faa684c, 0xbd, 0x0, r0}) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) sendmsg$AUDIT_SET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, 0x3e9, 0x100, 0x70bd2d, 0x25dfdbfe, {0x4, 0x1, 0x0, r3, 0x8, 0x8, 0x0, 0x0, 0x1}, ["", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x20) bind$isdn(r2, &(0x7f0000000180)={0x22, 0x91, 0xde, 0xff, 0x3f}, 0x6) r4 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x10001, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[{}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000180)={r5}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4010641c, &(0x7f0000000380)={r5, &(0x7f0000000340)=""/8}) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffb, 0x6, 0x0, @buffer={0x0, 0x18, &(0x7f00000000c0)=""/24}, &(0x7f0000001380)="59a59588ce5b", 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:18 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = openat$cgroup(r5, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000080)={{r6}, 0x8, 0x1e, 0x9}) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:18 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x200}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, 0xa0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r0, 0x81785501, &(0x7f00000000c0)=""/143) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2422.013878] FAULT_INJECTION: forcing a failure. [ 2422.013878] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2422.069468] CPU: 0 PID: 13554 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2422.077380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2422.086737] Call Trace: [ 2422.089333] dump_stack+0x13e/0x194 [ 2422.092971] should_fail.cold+0x10a/0x14b [ 2422.097131] __alloc_pages_nodemask+0x1bf/0x700 [ 2422.101812] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2422.106846] alloc_pages_current+0xe7/0x1e0 [ 2422.111181] sg_build_indirect.isra.0+0x377/0x950 [ 2422.116206] sg_common_write.isra.0+0x8be/0x1e20 [ 2422.120977] ? sg_open+0x1490/0x1490 [ 2422.124693] ? find_held_lock+0x2d/0x110 [ 2422.128760] ? cap_capable+0x1c4/0x230 [ 2422.132655] ? security_capable+0x88/0xb0 [ 2422.136811] ? ns_capable_common+0x127/0x150 [ 2422.141225] sg_new_write.isra.0+0x581/0x8c0 [ 2422.145639] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2422.150681] ? scsi_block_when_processing_errors+0x268/0x340 [ 2422.156483] ? scsi_ioctl_reset+0x740/0x740 [ 2422.160808] ? __lock_acquire+0x5f7/0x4620 [ 2422.165053] ? lock_downgrade+0x6e0/0x6e0 [ 2422.169209] sg_ioctl+0x1040/0x2620 [ 2422.172836] ? check_preemption_disabled+0x35/0x240 [ 2422.177857] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2422.182451] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2422.187032] do_vfs_ioctl+0x75a/0xfe0 [ 2422.190830] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2422.195586] ? ioctl_preallocate+0x1a0/0x1a0 [ 2422.200019] ? security_file_ioctl+0x76/0xb0 [ 2422.204429] ? security_file_ioctl+0x83/0xb0 [ 2422.208837] SyS_ioctl+0x7f/0xb0 [ 2422.212207] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2422.216193] do_syscall_64+0x1d5/0x640 [ 2422.220092] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2422.225278] RIP: 0033:0x45c829 [ 2422.228478] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2422.236186] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2422.243454] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2422.250725] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2422.257993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2422.265258] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:18 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:18 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x810, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xa0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={r6, 0xffffffff}, &(0x7f0000000100)=0x8) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:18 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000180)) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0xffffffff}, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xa0) ioctl$TIOCGPKT(r0, 0x80045438, &(0x7f00000000c0)) r4 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0xfffffffffffffff9, 0x2000) ioctl$SNDCTL_DSP_STEREO(r4, 0xc0045003, &(0x7f0000000200)) r5 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NFT_MSG_GETOBJ_RESET(r7, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, 0x15, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0xc851}, 0x4000000) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f0000000340)={0x8, 0x120, 0xfa00, {0x1, {0x5, 0x8, "2d1c01e4865ab216e489f710ed48b0d4b18af32ffb79fcd673253f7db98954bf36891ccea282d7b02b802d5cc0fdddcc99b968159fb9ac59325bf1cad09126061086dea389cea41504724f36a00950c8c13229e8c6aebd51e49a8b6469326147492b2892104fe5498b522062e368ed4111980f8a8bffcaf7118e20878b7e000240e40ada211143f5aaff9bfb26c7e3b8d0ac567fbb0ac80461d98c0a75ec74eac0c6091ab507bbd2e4b1ac70d972ddef3cd9066eb2c57c0562a64e0d2a708fc5b7d8253613de80c811ea79bb5c88444d60fa67cf331601216a4b22116ce44d0c342b570e9b989b5d2f9c4059867ecf3638552c4a455190fb1f30ae49c4fb002c", 0x2, 0xe, 0x0, 0x80, 0xc3, 0xff, 0x8, 0x1}, r8}}, 0x128) 21:55:18 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x20000000000, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x85, 0x3f, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="59a59579625b59665cfc60adc8794a8ea5f9f0816a92c8f59a033218f7c90eebaa33ab5bb7e4bb11868ebd7fc42aa4cc0290d0869338637757a01f57a23cb038585e8ab6b462e4b6a39d60f7945c0c007ba35c977ab4305e5c3a4d87cd4d2093a7a42e7d8540a486382b9f31e32dc8f2f59f0aeca4b61842070f7297dcebba2a461e1c592a", 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:18 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @bcast, @rose, @rose, @null]}, 0x48) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x1, 'veth1_to_bridge\x00', {}, 0x800}) bind$netrom(r0, 0x0, 0x0) 21:55:18 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x7, 0x5814c0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffffffffffe, 0x27, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000040)="59fd00000000000019c2000889d0c619a59588c65b83ebb7bec13c69034a81fe480815dde1a78f", 0x0, 0x0, 0x8036, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x4400, 0x0) 21:55:18 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f00000000c0)={0xb, {0x81, 0x3f, 0x7ff, 0x3f}}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:18 executing program 5: io_setup(0x0, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NFNL_MSG_ACCT_NEW(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x7, 0x101, 0x0, 0x0, {0xc, 0x0, 0x2}, [@NFACCT_FILTER={0x1c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x6}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x7ff}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x4f}]}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x83}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x9}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x390b}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x20000814) 21:55:19 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000440)={0x1003, 0xcb95, 0x7, 0x9298, 0xffff, 0x8}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) lsetxattr$trusted_overlay_redirect(&(0x7f00000002c0)='./bus\x00', &(0x7f0000000300)='trusted.overlay.redirect\x00', &(0x7f0000000340)='./bus\x00', 0x6, 0x2) setsockopt$packet_int(r3, 0x107, 0x9, &(0x7f0000000280)=0x7, 0x4) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f0000000380)={0x7b, 0x0, [0x20, 0xbc, 0xfffffffffffffffe, 0x8]}) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000400)=0x1490b835) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f00000000c0)="0fc71d660f3808bb00a0baf80c66b8624ec78266efbafc0cb0fceefb0fc76ca3baf80c66b8eef5d58c66efbafc0cedb819000f00d80f38cb8ccda466b8020000000f23d00f21f866350000000c0f23f83e0fc19d0400", 0xfffffffffffffc85}], 0x1, 0x6, &(0x7f0000000180), 0x0) 21:55:19 executing program 5: io_setup(0x0, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:19 executing program 1 (fault-call:1 fault-nth:9): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2422.911445] FAULT_INJECTION: forcing a failure. [ 2422.911445] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2422.971729] CPU: 0 PID: 13635 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2422.979650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2422.989006] Call Trace: [ 2422.991618] dump_stack+0x13e/0x194 [ 2422.995261] should_fail.cold+0x10a/0x14b [ 2422.999421] __alloc_pages_nodemask+0x1bf/0x700 [ 2423.004098] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2423.009127] alloc_pages_current+0xe7/0x1e0 [ 2423.013457] sg_build_indirect.isra.0+0x377/0x950 21:55:19 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000100)={0x4, 0x18, [0x8, 0x2, 0x3b9, 0x800, 0xffffffff, 0x1]}) [ 2423.018313] sg_common_write.isra.0+0x8be/0x1e20 [ 2423.023086] ? sg_open+0x1490/0x1490 [ 2423.026812] ? find_held_lock+0x2d/0x110 [ 2423.030998] ? cap_capable+0x1c4/0x230 [ 2423.034983] ? security_capable+0x88/0xb0 [ 2423.039136] ? ns_capable_common+0x127/0x150 [ 2423.043561] sg_new_write.isra.0+0x581/0x8c0 [ 2423.047990] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2423.053031] ? scsi_block_when_processing_errors+0x268/0x340 [ 2423.058832] ? scsi_ioctl_reset+0x740/0x740 [ 2423.063159] ? __lock_acquire+0x5f7/0x4620 [ 2423.067397] ? lock_downgrade+0x6e0/0x6e0 21:55:19 executing program 5: io_setup(0x0, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2423.071553] sg_ioctl+0x1040/0x2620 [ 2423.075186] ? check_preemption_disabled+0x35/0x240 [ 2423.080209] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2423.084801] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2423.089387] do_vfs_ioctl+0x75a/0xfe0 [ 2423.093190] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2423.097954] ? ioctl_preallocate+0x1a0/0x1a0 [ 2423.102380] ? security_file_ioctl+0x76/0xb0 [ 2423.106791] ? security_file_ioctl+0x83/0xb0 [ 2423.111208] SyS_ioctl+0x7f/0xb0 [ 2423.114575] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2423.118557] do_syscall_64+0x1d5/0x640 [ 2423.122457] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2423.127644] RIP: 0033:0x45c829 [ 2423.130828] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2423.138535] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2423.145806] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2423.153075] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2423.160341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2423.167611] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:19 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = accept$phonet_pipe(r1, 0x0, &(0x7f0000000040)) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r2, 0xc0506617, &(0x7f0000000280)={{0x2, 0x0, @reserved="476b3cd0b805bbbd9ad59c1cfd6036e238e47788d6cacee70213ee6ee869e397"}, 0xba, [], "2294bd0d2f69d3d968cf2901d068eab05508c58d7150b1aaea2ba891491d960f76becdfcfab3e6c9b62038b33b6eaa65ef3976ecb8c8c42d4d6762d29e8a802d09bacae724236f77c4da6ffc7cf0ef03ce2a7a8bca2790fed53ba78bfdd6a4998fc400ef0e2249b64ec5e41bd1b3961a2859dcc2874cf9cd4d43519cf2ccba76990b2045665985d6e6482693d7a2d5987970a2277b779fd05031802a52ffff75e505bc9c4f1730664b8dabd360c214d2183594009b3c34529216"}) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000000)=0x1) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @bcast, @rose, @rose, @null]}, 0x48) bind$netrom(r3, 0x0, 0x0) 21:55:19 executing program 1 (fault-call:1 fault-nth:10): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:19 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x2, 0x80) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) openat$random(0xffffffffffffff9c, &(0x7f0000000140)='/dev/urandom\x00', 0x20000, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f0000000040)="86b8eaa82f34332b298044c26d6444af8bced8a4d7410c9ce7bae50973bc9b28704cb58ca550d439af284c43f7f2448a0dbe49a8662f24ca5e3e352dece306118e81855ae06d1d3f12c0b8db4697fc7eac76cd148de6a03c1f5bdf92167966ee3545b91f0c566c5e19c35236a17cd70a924d") [ 2423.296946] FAULT_INJECTION: forcing a failure. [ 2423.296946] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2423.348191] CPU: 1 PID: 13661 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2423.356105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2423.365462] Call Trace: [ 2423.368066] dump_stack+0x13e/0x194 [ 2423.371709] should_fail.cold+0x10a/0x14b [ 2423.375867] __alloc_pages_nodemask+0x1bf/0x700 [ 2423.380547] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2423.385582] alloc_pages_current+0xe7/0x1e0 [ 2423.389917] sg_build_indirect.isra.0+0x377/0x950 [ 2423.394784] sg_common_write.isra.0+0x8be/0x1e20 [ 2423.399555] ? sg_open+0x1490/0x1490 [ 2423.403271] ? find_held_lock+0x2d/0x110 [ 2423.407355] ? cap_capable+0x1c4/0x230 [ 2423.411250] ? security_capable+0x88/0xb0 [ 2423.415402] ? ns_capable_common+0x127/0x150 [ 2423.419817] sg_new_write.isra.0+0x581/0x8c0 [ 2423.424233] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2423.429272] ? scsi_block_when_processing_errors+0x268/0x340 [ 2423.435075] ? scsi_ioctl_reset+0x740/0x740 [ 2423.439409] ? __lock_acquire+0x5f7/0x4620 [ 2423.443646] ? lock_downgrade+0x6e0/0x6e0 [ 2423.447797] sg_ioctl+0x1040/0x2620 [ 2423.451427] ? check_preemption_disabled+0x35/0x240 [ 2423.456450] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2423.461057] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2423.465641] do_vfs_ioctl+0x75a/0xfe0 [ 2423.469443] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2423.474204] ? ioctl_preallocate+0x1a0/0x1a0 [ 2423.478639] ? security_file_ioctl+0x76/0xb0 [ 2423.483049] ? security_file_ioctl+0x83/0xb0 [ 2423.487461] SyS_ioctl+0x7f/0xb0 [ 2423.490829] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2423.494807] do_syscall_64+0x1d5/0x640 [ 2423.498716] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2423.503903] RIP: 0033:0x45c829 [ 2423.507090] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2423.514801] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2423.522069] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2423.529339] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2423.536606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 21:55:19 executing program 5: io_setup(0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) 21:55:19 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0xa8, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="fd4aa1d96ddca7b6ff00000000fffff55baeff89987aec51e840aff8fce2f329f643dbe1bae18203593d16e96a7d782c5d2cbaafa6e2f29d16fbc646df2e4cf8bc48c32db8c953a89d7398db2f3d5c63a8afadcc740264c04b2636b34f9f03dc7a57b2cc457a14fa75dda6b77728704eaf3ac01784e34143a11d108975499a2f50e0b314b9e4dd87da3792190604b530abc93181929100a6d8d27cc58b760f1d9e325c4a45f845a3", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2423.543873] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:20 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="040000814100000000000000000000000000ee34166ecf000a1ad54c85075b4d50dfcc6a243ed9bcc77a7764a407e57d6adbb49d9f6d1a4080f8288a63701138325846c5df43c87e7aeab55ba0b7dfa66c97af9e934d6868a4b4147af6ced31d806a", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0xa0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:20 executing program 4: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x2}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1000}}, 0xa0) accept$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x10024, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_AUTH_MAGIC(r2, 0x40046411, &(0x7f0000000180)=0x8) 21:55:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x0, {0x0, 0x4}, 0x44, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xcb0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}}, 0xa0) r3 = dup2(r1, r2) stat(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r8) r9 = getgid() r10 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r11, 0x0, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f00000002c0)='system.posix_acl_default\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="02000000010003000000000002000600", @ANYRES32=0x0, @ANYBLOB="030001004c2b913d0fe3ff87512688b77a0446fa99219284e34cde18553148a7f7ae52b4ea45c2176defe952de7f3d3d3b49401922ee47b98b2e37e8b9857a8db0548945df32af8bc27bedcc9f49717aa58ea24ad32eb658540c9b76f78f901f004b2ace086122bb389f799d6dabf3cc3d2b9729e7c79ab81cc6c18ec989fc5df58bd562c777e56fff8a9b233b6520bf1bcd8455daaa5197244b972b812de2b2e888008a1e9f39b0ac7910a7e8dcb81af7230fd5f6c0597f019bbf8aef001e081c9dfa350f", @ANYRES32=0x0, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="02000700", @ANYRES32=0x0, @ANYBLOB="02000500", @ANYRES32=0x0, @ANYBLOB="02000000", @ANYRES32=r4, @ANYBLOB="02000000", @ANYRES32=r6, @ANYBLOB="02000100", @ANYRES32=r8, @ANYBLOB="040001000000000008000600", @ANYRES32=r9, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=r11, @ANYBLOB="10000400000000002000060000000000"], 0x74, 0x3) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1, 0x23ba, 0xa9, 0x7}, 0x10) 21:55:20 executing program 1 (fault-call:1 fault-nth:11): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:20 executing program 5: io_setup(0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) [ 2423.885882] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2423.894758] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2423.900846] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2423.909797] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2423.918749] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 [ 2423.931219] FAULT_INJECTION: forcing a failure. 21:55:20 executing program 5: io_setup(0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) [ 2423.931219] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2424.002620] CPU: 1 PID: 13704 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2424.010624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2424.019981] Call Trace: [ 2424.022669] dump_stack+0x13e/0x194 [ 2424.026320] should_fail.cold+0x10a/0x14b [ 2424.030487] __alloc_pages_nodemask+0x1bf/0x700 [ 2424.035169] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2424.040207] alloc_pages_current+0xe7/0x1e0 [ 2424.044535] sg_build_indirect.isra.0+0x377/0x950 [ 2424.049396] sg_common_write.isra.0+0x8be/0x1e20 [ 2424.054168] ? sg_open+0x1490/0x1490 [ 2424.057886] ? find_held_lock+0x2d/0x110 [ 2424.061953] ? cap_capable+0x1c4/0x230 [ 2424.065848] ? security_capable+0x88/0xb0 [ 2424.070023] ? ns_capable_common+0x127/0x150 [ 2424.074447] sg_new_write.isra.0+0x581/0x8c0 [ 2424.078865] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2424.083902] ? scsi_block_when_processing_errors+0x268/0x340 [ 2424.089701] ? scsi_ioctl_reset+0x740/0x740 [ 2424.094027] ? __lock_acquire+0x5f7/0x4620 [ 2424.098264] ? lock_downgrade+0x6e0/0x6e0 [ 2424.102418] sg_ioctl+0x1040/0x2620 [ 2424.106056] ? check_preemption_disabled+0x35/0x240 [ 2424.111078] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2424.115673] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2424.120259] do_vfs_ioctl+0x75a/0xfe0 [ 2424.124063] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2424.128823] ? ioctl_preallocate+0x1a0/0x1a0 [ 2424.133247] ? security_file_ioctl+0x76/0xb0 [ 2424.137657] ? security_file_ioctl+0x83/0xb0 [ 2424.142072] SyS_ioctl+0x7f/0xb0 [ 2424.145461] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2424.149448] do_syscall_64+0x1d5/0x640 [ 2424.153344] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2424.158532] RIP: 0033:0x45c829 [ 2424.161728] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2424.169439] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2424.176708] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2424.183980] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2424.191251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2424.198518] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:20 executing program 4: prlimit64(0x0, 0x7, &(0x7f0000000280)={0x9, 0x9d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9, 0x0, 0x100000000000000, 0xffffffffffffffff}, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x3, 0xfb) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000100)={'bond0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'bond0\x00', 0x800000000008a03}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) getpid() syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x454, 0x8000) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='rdma.current\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="0b002dbd7000000000000400003d3300cf2653c9fa2da267ee691c276552f9151068fce86497d0ecb91b1bfd262174eeb966c478af2e75cfff563e6ed9a53b38ef000000fe23d93b59fe62ead6bb231a1e023ca3e28c5c124fe8a74e0b47f8db18954190a61f52cfe6df196166dd643263"], 0x14}}, 0x0) 21:55:20 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x20000) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r1) r3 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000900)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228897501f93191b076ac446ff0022b8753a1fa74ff569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23", 0x395, r2) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x113001, 0x0) ioctl$KVM_DEASSIGN_DEV_IRQ(r4, 0x4040ae75, &(0x7f00000001c0)={0x3, 0x9, 0x5, 0x402}) r5 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r5, r3, r5}, &(0x7f0000000700)=""/243, 0x356, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x02\x00\x00\x00\x0f\x00@\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, &(0x7f0000000180)}) r6 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r7 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r6) add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000900)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228897501f93191b076ac446ff0022b8753a1fa74ff569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23", 0x395, r7) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_tcp_TCP_MD5SIG(r8, 0x6, 0xe, &(0x7f0000000240)={@in={{0x2, 0x4e24, @remote}}, 0x0, 0x0, 0x27, 0x0, "d2e9b0e36996265c677f4d88d985a447c51457073367cb8917aece65cde47da2f1e99d3d469d6d2f8886ff758fe0eece65efad6f124b5d1413ce60fceb8510e516c8b68783f6cb2a1188e88e42c36e29"}, 0xd8) keyctl$unlink(0x9, r3, r7) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:20 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000000c0)={@private=0xa010100, @remote}, 0xc) 21:55:20 executing program 1 (fault-call:1 fault-nth:12): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:20 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2424.499737] FAULT_INJECTION: forcing a failure. [ 2424.499737] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2424.551454] CPU: 1 PID: 13752 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2424.559369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2424.568727] Call Trace: [ 2424.571324] dump_stack+0x13e/0x194 [ 2424.574969] should_fail.cold+0x10a/0x14b [ 2424.579130] __alloc_pages_nodemask+0x1bf/0x700 [ 2424.583807] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2424.588845] alloc_pages_current+0xe7/0x1e0 [ 2424.593176] sg_build_indirect.isra.0+0x377/0x950 [ 2424.598042] sg_common_write.isra.0+0x8be/0x1e20 [ 2424.602817] ? sg_open+0x1490/0x1490 [ 2424.606545] ? find_held_lock+0x2d/0x110 [ 2424.610615] ? cap_capable+0x1c4/0x230 [ 2424.614521] ? security_capable+0x88/0xb0 [ 2424.618675] ? ns_capable_common+0x127/0x150 [ 2424.623092] sg_new_write.isra.0+0x581/0x8c0 [ 2424.627509] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2424.632551] ? scsi_block_when_processing_errors+0x268/0x340 [ 2424.638352] ? scsi_ioctl_reset+0x740/0x740 [ 2424.642677] ? __lock_acquire+0x5f7/0x4620 [ 2424.646917] ? lock_downgrade+0x6e0/0x6e0 [ 2424.651075] sg_ioctl+0x1040/0x2620 [ 2424.654705] ? check_preemption_disabled+0x35/0x240 [ 2424.659724] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2424.664323] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2424.668913] do_vfs_ioctl+0x75a/0xfe0 [ 2424.672716] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2424.677482] ? ioctl_preallocate+0x1a0/0x1a0 [ 2424.681906] ? security_file_ioctl+0x76/0xb0 [ 2424.686337] ? security_file_ioctl+0x83/0xb0 [ 2424.690753] SyS_ioctl+0x7f/0xb0 [ 2424.694127] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2424.698153] do_syscall_64+0x1d5/0x640 [ 2424.702165] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2424.707356] RIP: 0033:0x45c829 [ 2424.710542] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2424.718253] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2424.725521] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2424.732792] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2424.740064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 21:55:21 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:21 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_MODE_DIRTYFB(r1, 0xc01864b1, &(0x7f0000000100)={0x4bb0, 0x2, 0xfe3, 0x8, &(0x7f00000000c0)=[{0x3, 0x6, 0x80, 0x3ff}, {0xffff, 0xdde1, 0x0, 0xfffd}, {0x200, 0x2, 0x1, 0x76a8}, {0x7, 0x8, 0xfce9, 0xfe01}, {0x5, 0x5, 0x9, 0x4}, {0xfff8, 0x7fff, 0x0, 0x401}, {0x2, 0x3, 0x7}, {0x0, 0x3, 0x6}]}) 21:55:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000000), &(0x7f0000000700)=""/243, 0x356, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x02\x00\x00\x00\x0f\x00@\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, &(0x7f0000000180)}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r8, 0x0, 0x0) keyctl$chown(0x4, 0x0, r6, r8) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @scatter={0x0, 0x0, &(0x7f0000000080)}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) poll(&(0x7f0000000040)=[{r1, 0x192}, {r0, 0x4020}, {r2, 0x84}, {r3, 0x84}, {r4, 0x400}], 0x5, 0x80000001) 21:55:21 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2424.747339] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00') 21:55:21 executing program 1 (fault-call:1 fault-nth:13): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:21 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2424.961289] FAULT_INJECTION: forcing a failure. [ 2424.961289] name fail_page_alloc, interval 1, probability 0, space 0, times 0 21:55:21 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045540, &(0x7f0000000180)=0x401) nanosleep(&(0x7f00000000c0)={0x77359400}, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = fcntl$dupfd(r2, 0x406, r0) ioctl$SNDCTL_DSP_SETTRIGGER(r3, 0x40045010, &(0x7f0000000100)=0x1) 21:55:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) bind$unix(r1, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2425.014447] CPU: 0 PID: 13782 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2425.022361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2425.031717] Call Trace: [ 2425.034314] dump_stack+0x13e/0x194 [ 2425.037956] should_fail.cold+0x10a/0x14b [ 2425.042116] __alloc_pages_nodemask+0x1bf/0x700 [ 2425.046791] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2425.051823] alloc_pages_current+0xe7/0x1e0 [ 2425.056159] sg_build_indirect.isra.0+0x377/0x950 [ 2425.061019] sg_common_write.isra.0+0x8be/0x1e20 [ 2425.065791] ? sg_open+0x1490/0x1490 [ 2425.069543] ? find_held_lock+0x2d/0x110 [ 2425.073617] ? cap_capable+0x1c4/0x230 [ 2425.077511] ? security_capable+0x88/0xb0 [ 2425.081665] ? ns_capable_common+0x127/0x150 [ 2425.086077] sg_new_write.isra.0+0x581/0x8c0 [ 2425.090500] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2425.095539] ? scsi_block_when_processing_errors+0x268/0x340 [ 2425.101340] ? scsi_ioctl_reset+0x740/0x740 [ 2425.105667] ? __lock_acquire+0x5f7/0x4620 [ 2425.109905] ? lock_downgrade+0x6e0/0x6e0 [ 2425.114061] sg_ioctl+0x1040/0x2620 [ 2425.117786] ? check_preemption_disabled+0x35/0x240 [ 2425.122802] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2425.127394] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2425.131978] do_vfs_ioctl+0x75a/0xfe0 [ 2425.135777] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2425.140549] ? ioctl_preallocate+0x1a0/0x1a0 [ 2425.144967] ? security_file_ioctl+0x76/0xb0 [ 2425.149375] ? security_file_ioctl+0x83/0xb0 [ 2425.153788] SyS_ioctl+0x7f/0xb0 [ 2425.157151] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2425.161131] do_syscall_64+0x1d5/0x640 [ 2425.165031] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2425.170215] RIP: 0033:0x45c829 [ 2425.173400] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2425.181110] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2425.188379] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2425.195646] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2425.202915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2425.210182] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 [ 2425.252133] selinux_nlmsg_perm: 361 callbacks suppressed [ 2425.252143] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 21:55:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$BLKGETSIZE64(r1, 0x80081272, &(0x7f00000000c0)) 21:55:21 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:21 executing program 2: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x3, 0x1d5b01) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x85002, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)) socket$inet_sctp(0x2, 0x0, 0x84) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000000d14000229bd7000fcdbdf250800010002001e000800010001000000"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4004) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x33, 0x0, 0xb, 0x3, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_COMPAT_NAME={0xd, 0x1, '/dev/sg#\x00'}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_COMPAT_NAME={0xd, 0x1, '/dev/sg#\x00'}, @NFTA_COMPAT_NAME={0x5, 0x1, '\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40014}, 0x4048840) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x8000, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SOUND_MIXER_READ_RECMASK(r2, 0x80044dfd, &(0x7f00000003c0)) ioctl$RTC_AIE_ON(r1, 0x7001) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000040)={0x32, 0x4, 0x0, {0x0, 0x5, 0xa, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x32) [ 2425.413227] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.470060] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.539577] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.617781] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.680738] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.733665] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.779274] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 [ 2425.828870] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13775 comm=syz-executor.3 21:55:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000040)={0x1, 0xbe, 0xeed}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ocfs2_control\x00', 0x743142, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f00000003c0)={&(0x7f00000000c0)="0a5d43b3864a850f715a0c25b73223227f4877581625290385146af034b10ccbb790447a2194eac8adce5d5d2c4c9ed313fc9e983a3c9f5794d64532be4284d223a18b6ea416cea2706d908a96a8c465bf859ec3b5ffc83fc7d4d7ab4976f8bb638522b4d2e223ebe0a1a15598fc1ae18b8b26079cb31e6572daabe3baefd9951f4cc32cfd2b0fad7d7f5e118dcc91cc44dfcc6798a91f3854971bb4791a15218f084d345210c456f85745c51c3a9c66032e05d8434bf25e50f3698b31d390a781a8fc108df7ed5a9a8d16e56add7ac583b866ea767d9fe73f6ace5178d5df2015f6d06a34ec2f3e01c07e94e37efde69c856ce401a9a3a0", &(0x7f00000001c0)=""/222, &(0x7f00000002c0)="7d4eeec80617dc7228d2e53258e83bfb14ce503f692c4be80e92af1ef7e92209e7715e7df67193f80b4bb9ab6e3abc8e4d54e1ab00a4b11ee0a3aae12b6d0ae863cccbc9c6ac3f9060957897c66321d27ceba6f7c816b937ce39532274912f38885652", &(0x7f0000000340)="7ea81d3da9a5996df6f2634e4272", 0x1, r1, 0x4}, 0x38) 21:55:22 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:22 executing program 1 (fault-call:1 fault-nth:14): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2425.962345] FAULT_INJECTION: forcing a failure. [ 2425.962345] name fail_page_alloc, interval 1, probability 0, space 0, times 0 21:55:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x200000000000a0, 0x161400) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f00000000c0)={0x40, 0x6, 0x40, 0x10000, 0x8, 0x2}) [ 2426.003299] CPU: 0 PID: 13834 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2426.011212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2426.020566] Call Trace: [ 2426.023162] dump_stack+0x13e/0x194 [ 2426.026798] should_fail.cold+0x10a/0x14b [ 2426.030955] __alloc_pages_nodemask+0x1bf/0x700 [ 2426.035628] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2426.040668] alloc_pages_current+0xe7/0x1e0 [ 2426.044997] sg_build_indirect.isra.0+0x377/0x950 [ 2426.049850] sg_common_write.isra.0+0x8be/0x1e20 [ 2426.054618] ? sg_open+0x1490/0x1490 [ 2426.058332] ? find_held_lock+0x2d/0x110 [ 2426.062394] ? cap_capable+0x1c4/0x230 [ 2426.066283] ? security_capable+0x88/0xb0 [ 2426.069400] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13845 comm=syz-executor.3 [ 2426.070428] ? ns_capable_common+0x127/0x150 [ 2426.070443] sg_new_write.isra.0+0x581/0x8c0 [ 2426.070458] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2426.096312] ? scsi_block_when_processing_errors+0x268/0x340 [ 2426.102113] ? scsi_ioctl_reset+0x740/0x740 [ 2426.106438] ? __lock_acquire+0x5f7/0x4620 [ 2426.110676] ? lock_downgrade+0x6e0/0x6e0 [ 2426.114832] sg_ioctl+0x1040/0x2620 [ 2426.118463] ? check_preemption_disabled+0x35/0x240 [ 2426.123480] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2426.128079] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2426.132664] do_vfs_ioctl+0x75a/0xfe0 [ 2426.136465] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2426.141225] ? ioctl_preallocate+0x1a0/0x1a0 [ 2426.145649] ? security_file_ioctl+0x76/0xb0 [ 2426.150058] ? security_file_ioctl+0x83/0xb0 [ 2426.154475] SyS_ioctl+0x7f/0xb0 [ 2426.157845] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2426.161824] do_syscall_64+0x1d5/0x640 [ 2426.165734] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2426.170920] RIP: 0033:0x45c829 [ 2426.174104] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2426.181941] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2426.189206] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2426.196474] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2426.203744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2426.211011] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={r5, 0x1000}, &(0x7f0000000100)=0x8) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:22 executing program 1 (fault-call:1 fault-nth:15): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:22 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = dup2(r0, r0) sendmsg$NFT_BATCH(r1, &(0x7f0000000900)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x58, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELFLOWTABLE={0x1a4, 0x18, 0xa, 0x101, 0x0, 0x0, {0xc, 0x0, 0x7}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK={0x188, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xffffffff}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'netdevsim0\x00'}, {0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}, {0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'ip6erspan0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'ip_vti0\x00'}, {0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'macvtap0\x00'}, {0x14}, {0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'netdevsim0\x00'}, {0x14, 0x1, 'macvlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bridge_slave_1\x00'}, {0x14, 0x1, 'veth0_vlan\x00'}, {0x14, 0x1, 'veth0_to_batadv\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'dummy0\x00'}]}]}]}, @NFT_MSG_NEWCHAIN={0x70, 0x3, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_CHAIN_COUNTERS={0x28, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x3f}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x800}]}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x80}]}]}, @NFT_MSG_NEWSETELEM={0x5c, 0xc, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}], {0x14}}, 0x33c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x3fa, 0x0, 0x70bd2a, 0x25dfdbfb, {0x1, 0x1}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x20040010) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x4) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2400) bind$rose(r2, &(0x7f0000000380)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @bcast}, 0x1c) mount$9p_fd(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f00000001c0)='9p\x00', 0x80464, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wEdno=', @ANYRESHEX=r3, @ANYBLOB="2c6163636573733d616e792c76657273692e752c6d73697a653d307830303004ec6091dcc3ac79a69b303030303030303030303130302c646f6f73652c666f776e65723c003873153431c11f24993730ac8eb85f4a2663bb97a4e33f05cd39230fc79f154907e4eadd2da152399830291ab910faddc21312099650f7181ece88bfe8ce1d74000000000000000027c9cca70523cb67ff41ce8a0d89e73f8d559b1922e6a5eb9aeef6f618ac458d2fea7a4bac65c8a5f50971d127abb135749b83305903e4eec01a333cfdf2e5d6", @ANYRESDEC=r4, @ANYBLOB=',\x00']) 21:55:22 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2426.334291] FAULT_INJECTION: forcing a failure. [ 2426.334291] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2426.406345] CPU: 0 PID: 13861 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2426.414439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2426.423793] Call Trace: [ 2426.426392] dump_stack+0x13e/0x194 [ 2426.430032] should_fail.cold+0x10a/0x14b [ 2426.434189] __alloc_pages_nodemask+0x1bf/0x700 [ 2426.438869] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2426.443903] alloc_pages_current+0xe7/0x1e0 [ 2426.448235] sg_build_indirect.isra.0+0x377/0x950 [ 2426.453099] sg_common_write.isra.0+0x8be/0x1e20 [ 2426.457875] ? sg_open+0x1490/0x1490 [ 2426.461592] ? find_held_lock+0x2d/0x110 [ 2426.465663] ? cap_capable+0x1c4/0x230 [ 2426.469575] ? security_capable+0x88/0xb0 [ 2426.473727] ? ns_capable_common+0x127/0x150 [ 2426.478162] sg_new_write.isra.0+0x581/0x8c0 [ 2426.482581] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2426.487619] ? scsi_block_when_processing_errors+0x268/0x340 [ 2426.493416] ? scsi_ioctl_reset+0x740/0x740 [ 2426.497931] ? __lock_acquire+0x5f7/0x4620 [ 2426.502165] ? lock_downgrade+0x6e0/0x6e0 [ 2426.506325] sg_ioctl+0x1040/0x2620 [ 2426.509951] ? check_preemption_disabled+0x35/0x240 [ 2426.514966] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2426.519556] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2426.524143] do_vfs_ioctl+0x75a/0xfe0 [ 2426.527946] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2426.532723] ? ioctl_preallocate+0x1a0/0x1a0 [ 2426.537151] ? security_file_ioctl+0x76/0xb0 [ 2426.541566] ? security_file_ioctl+0x83/0xb0 [ 2426.546047] SyS_ioctl+0x7f/0xb0 [ 2426.549413] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2426.553390] do_syscall_64+0x1d5/0x640 [ 2426.557290] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2426.562477] RIP: 0033:0x45c829 [ 2426.565662] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2426.573374] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2426.580635] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2426.587901] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2426.595164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2426.602430] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={0x0, 0x80000, 0xffffffffffffffff}) preadv(r2, &(0x7f0000000200)=[{&(0x7f0000000100)=""/236, 0xec}], 0x1, 0xfffffffffffffffc) 21:55:22 executing program 1 (fault-call:1 fault-nth:16): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:22 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2426.750179] FAULT_INJECTION: forcing a failure. [ 2426.750179] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2426.788520] CPU: 0 PID: 13878 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2426.796434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2426.805790] Call Trace: [ 2426.808387] dump_stack+0x13e/0x194 [ 2426.812039] should_fail.cold+0x10a/0x14b [ 2426.816195] __alloc_pages_nodemask+0x1bf/0x700 [ 2426.820889] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2426.825928] alloc_pages_current+0xe7/0x1e0 [ 2426.830259] sg_build_indirect.isra.0+0x377/0x950 [ 2426.835123] sg_common_write.isra.0+0x8be/0x1e20 [ 2426.839905] ? sg_open+0x1490/0x1490 [ 2426.843622] ? find_held_lock+0x2d/0x110 [ 2426.847692] ? cap_capable+0x1c4/0x230 [ 2426.851586] ? security_capable+0x88/0xb0 [ 2426.855755] ? ns_capable_common+0x127/0x150 [ 2426.860168] sg_new_write.isra.0+0x581/0x8c0 [ 2426.864582] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2426.869617] ? scsi_block_when_processing_errors+0x268/0x340 [ 2426.875417] ? scsi_ioctl_reset+0x740/0x740 [ 2426.879748] ? __lock_acquire+0x5f7/0x4620 [ 2426.883983] ? lock_downgrade+0x6e0/0x6e0 [ 2426.888146] sg_ioctl+0x1040/0x2620 [ 2426.891778] ? check_preemption_disabled+0x35/0x240 [ 2426.896798] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2426.901394] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2426.905984] do_vfs_ioctl+0x75a/0xfe0 [ 2426.909876] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2426.914637] ? ioctl_preallocate+0x1a0/0x1a0 [ 2426.919063] ? security_file_ioctl+0x76/0xb0 [ 2426.923474] ? security_file_ioctl+0x83/0xb0 [ 2426.927881] SyS_ioctl+0x7f/0xb0 [ 2426.931248] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2426.935227] do_syscall_64+0x1d5/0x640 [ 2426.939125] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2426.944311] RIP: 0033:0x45c829 21:55:23 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SIOCX25SCAUSEDIAG(0xffffffffffffffff, 0x89ec, &(0x7f00000000c0)={0x74, 0xff}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f0000000100)={0x8001, 0x7f, 0x1}) [ 2426.947497] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2426.955214] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2426.962477] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2426.969743] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2426.977012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2426.984281] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 21:55:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x2, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:23 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) ioctl$VIDIOC_G_AUDOUT(0xffffffffffffffff, 0x80345631, &(0x7f00000000c0)) 21:55:23 executing program 1 (fault-call:1 fault-nth:17): r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:23 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) close(r1) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f00000000c0), 0x10) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) [ 2427.322642] FAULT_INJECTION: forcing a failure. [ 2427.322642] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2427.357025] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2427.359208] CPU: 1 PID: 13902 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 [ 2427.365860] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2427.373672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2427.373677] Call Trace: [ 2427.373696] dump_stack+0x13e/0x194 [ 2427.373714] should_fail.cold+0x10a/0x14b [ 2427.373730] __alloc_pages_nodemask+0x1bf/0x700 [ 2427.373743] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2427.373768] alloc_pages_current+0xe7/0x1e0 [ 2427.373783] sg_build_indirect.isra.0+0x377/0x950 [ 2427.373808] sg_common_write.isra.0+0x8be/0x1e20 [ 2427.373829] ? sg_open+0x1490/0x1490 [ 2427.379775] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2427.389039] ? find_held_lock+0x2d/0x110 [ 2427.389053] ? cap_capable+0x1c4/0x230 [ 2427.389067] ? security_capable+0x88/0xb0 [ 2427.389080] ? ns_capable_common+0x127/0x150 [ 2427.389093] sg_new_write.isra.0+0x581/0x8c0 [ 2427.389108] ? sg_common_write.isra.0+0x1e20/0x1e20 [ 2427.389137] ? scsi_block_when_processing_errors+0x268/0x340 21:55:23 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x100, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8923, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100)='NLBL_CIPSOv4\x00') sendmsg$NLBL_CIPSOV4_C_REMOVE(r3, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="1a83a9f25331f2c060d7f77959a2f8d4cb0baf48ba8a8d24a25bf5f947d295fb747f57b749cf9c62d9a5ff3ada239f3b62d2e25f348b729db5ccf8a8c771329c6867a9e6d3616c829a9eb1c09f0794b0d3760f6b", @ANYRES16=r4, @ANYBLOB="02002bbd7002ffdbdf250200000c080002312836c0b42097931c21fdab5a1eb3e475f2"], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00032cbd7000fbdbdf2502000000080001000300000008000200060000001c0108801c00078008000600f900000054000780080005009ce7951908000500856f8165080006005b00000008000600a0000000080005003f6c6852080005001ed4602e08000500a5124e2208000600e000000008000500af11974808000600cb000000340007801c0007800800050057a4520d080006007f0000000800050073fa0f77040007802400078008000600dc0000000800060040000000080005009c9a9172080005001a46ee622c000780080005003e58a23b08000500f42337300800060052000000080006004a000000080005008411514c1400078008000500a863b06008004b0000000000"], 0x140}, 0x1, 0x0, 0x0, 0x4004804}, 0x20044000) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="50010000", @ANYRES16=r4, @ANYBLOB="200028bd7000fcdbdf250100000024010c8024000b8008000900f8a8560c08000a001976000008000a00ed780000080009001366db150c000b80080009009af17a3324000b8008000a004fe6000008000900e5d9c31808000900872b521508000a008aaf00000c000b8008000900c039b61d04000b800c000b8008000900e782840f1c000b8008000a009070000008000a004e6a000008000900cf8161491c000b800800090028915d2c08000900b1ba554a08000900ad0df56e4c000b800800090024de747a080009004180ab229feab01527cb48fb15ad6f4208000a004c03000008000900b797391208000900a1d1d9200800090070d498770800090062808a630800090063f0650008000a006fd600002c000b8008000a006ba80000080009001f68dd7108000a00125d000008000a001fa10000080009002b28770a08000100010000000800010066f2b482be78387c4b7a261045851b47e5a79c01659d5ae6d8ed13374f839b8d842b7fe5f677f16cdae8a0915fc7cc17c49d22b3d3c7b8d874cae9a283c68d3ae121eab9f018b671b6fd6942fe435b66c530bb6dd8d102"], 0x150}, 0x1, 0x0, 0x0, 0x2004000}, 0x4) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60010000", @ANYRES16=r4, @ANYBLOB="00022abd7000fcdbdf2502000000b8000c8034000b8008000900699c0e1908000900cf58dd1d08000a00a377000008000900a8b1e70a08000a006b30000008000900b423684024000b8008000a005116000008000900e388046508000900c85aa32108000a65463d00002c000b8008000900ae820c5908000900974d6f1508000a003b7d0000080009009cc6df3808000900782291530c000b8008000a00c5cd000024000b8008000a009d70000008000a00a1cf000008000900fe12196508000900fe63cc3f0800020001000000080002000300000008000200020000001400048005000300070000000500030001000000040004803400048005000300050000000500030000000000050003000500000005000300010000000500030000000000050003000600000008000100ffffffff24000480050003000500007744000300010000000500030007000000050003000700000004000480"], 0x160}, 0x1, 0x0, 0x0, 0x24000090}, 0x4000817) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800e3ff", @ANYRES16=r4, @ANYBLOB="100027bd7000fddbdf2501000000240004800500030000000000050003000000000005000300020000000500030000000000"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x40) sendmsg$NLBL_CIPSOV4_C_LIST(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x48, r4, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x4}, {0x5}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x2}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000081}, 0x240088d0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x1a0, r4, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_MLSLVLLST={0xb8, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3a1e902b}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb9}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x695a6a0}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6cbf5c2a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1e908f7d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa1a5066}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x66}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4d}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x291d9adc}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12c633f0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7203bfd6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x16}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1b}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0x94, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3b3f1290}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x64a6a862}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7623d6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x33}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x204ddd7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7439ff83}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x49adb36b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x42}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xed}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xea}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x566241f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x76}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x10}, 0x40001) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd4, r4, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0xb8, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xc0ed290}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeb52}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x300d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x63bf06d8}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb8bc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3699100f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x14f9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7bd970f7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3622eb4c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd4ac}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x32f1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x50893a8d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6c15a99e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b0c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6709}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5dee26c0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x27aba73b}]}, {0x4}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x86c4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x766d08a1}]}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8080}, 0x801) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x160, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_TAGLST={0x44, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0xc}, {0x5}, {0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x44, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0xa8, 0xc, 0x0, 0x1, [{0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xf763c0f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x53e9ad1c}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4da98180}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeb5a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x318cbdd0}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x59ab}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x14fb5c90}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2d7aa982}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5e10c76a}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd3ca}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x68e416b6}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2544}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x723}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3c491cd8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3030cd58}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x58c219ec}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8856}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x776b48c1}]}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x4}, 0x20000180) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x80000001}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000140)={r5, 0xdff4}, 0x8) [ 2427.391727] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2427.395426] ? scsi_ioctl_reset+0x740/0x740 [ 2427.399629] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 [ 2427.404214] ? __lock_acquire+0x5f7/0x4620 [ 2427.404225] ? lock_downgrade+0x6e0/0x6e0 [ 2427.404240] sg_ioctl+0x1040/0x2620 [ 2427.498303] ? check_preemption_disabled+0x35/0x240 [ 2427.503325] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2427.507926] ? sg_new_write.isra.0+0x8c0/0x8c0 [ 2427.512511] do_vfs_ioctl+0x75a/0xfe0 [ 2427.516322] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2427.521083] ? ioctl_preallocate+0x1a0/0x1a0 [ 2427.525509] ? security_file_ioctl+0x76/0xb0 [ 2427.529920] ? security_file_ioctl+0x83/0xb0 [ 2427.534337] SyS_ioctl+0x7f/0xb0 [ 2427.537706] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2427.541685] do_syscall_64+0x1d5/0x640 [ 2427.545588] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2427.550789] RIP: 0033:0x45c829 [ 2427.550964] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2427.553967] RSP: 002b:00007f185c69ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2427.553980] RAX: ffffffffffffffda RBX: 00000000004eac00 RCX: 000000000045c829 [ 2427.553987] RDX: 0000000020000040 RSI: 0000000000002285 RDI: 0000000000000003 [ 2427.553993] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2427.554000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2427.554006] R13: 0000000000000483 R14: 00000000004c73bd R15: 00007f185c69f6d4 [ 2427.607133] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2427.613127] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 21:55:23 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) prctl$PR_GET_TIMERSLACK(0x1e) [ 2427.622077] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2427.631041] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 21:55:23 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x4, 0x0) close(0xffffffffffffffff) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:24 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010001f070000006800080000faff8141216996c1e2b9d37f2ca05d5c6f8c61c5df83abc915012567ad355a5337082ae63737337aae6905180cadc600", @ANYRES32=0x0, @ANYBLOB="0000000000000000313cb0308abc6d9374073d280012800a00586a373e5702"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) getsockopt$IP_SET_OP_GET_BYINDEX(r4, 0x1, 0x53, &(0x7f0000000040)={0x7, 0x7, 0xffffffffffffffff}, &(0x7f0000000080)=0x28) 21:55:24 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:24 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0xff, @buffer={0x0, 0xb9, &(0x7f0000000380)=""/185}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd6c330656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x10020, 0xffffffffffffffff, &(0x7f00000001c0)}) dup(r1) 21:55:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="00082aa77000ffdbdf25200000000500060000000000546f61e89329c2eea4138e4f989474403e9a31b3fef9c8fdf4afe937153140aac692b06656274ecbba43b768e6d45062fe8e23d85aae01be7022"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x44090) [ 2427.976736] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2427.985589] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2427.991676] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2428.000603] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2428.010125] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 21:55:24 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2428.067034] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2428.076013] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2428.082035] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2428.090980] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2428.099917] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 21:55:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f00000000c0)) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000100)={0x100, 'syz0\x00'}) 21:55:24 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x4, 0x4000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:24 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) lookup_dcookie(0x1, &(0x7f00000000c0)=""/4096, 0x1000) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x4, 0x4) ioctl$PPPIOCCONNECT(r1, 0x4004743a, &(0x7f00000010c0)=0x4) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$FUSE_NOTIFY_DELETE(r2, &(0x7f0000001100)={0x32, 0x6, 0x0, {0x0, 0x4, 0x9, 0x0, '/dev/sg#\x00'}}, 0x32) 21:55:24 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x4, 0x10000) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000100)) 21:55:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x61, 0x0, @buffer={0x0, 0x0, &(0x7f00000000c0)=""/68}, &(0x7f0000000500)="59a59588c65bfbab0003b49b9123211d7b5056271707c6be117e98a12be6a2657b696607a96a589d08cabae27d8890d83080ccf24e91a8382efd58f75195983a3840433da42fe1675c19ad687f4f1c551feed00277703f5a24a42396b7f02d184aa10d06221e6a32f3321518e8cf1f5e826802037e7335ea71a2bd7b2bde53b7cac63e9e0953b74f9d91b9d953ca3ad3c8830046dda2afb1d3a36f440bfcc01f7b9ca66ec326e59b5c6c2216b1fff13193a6dcbfdc63c5216a4c5b4e1ea92c72e8d1e0ac668a66193a29fc2dc7e57db0e9692f4209e099aa12ddc4007445dbd8c9f0cd35bd8fb9f9f372a1238fa913801b4c49bdb23a0065928dfce0dc486bf8bc2eafa51b4ae8eaf5a00e14d25db208cc16062700000000000000000000000aec32dca7e553d7924eabe423da33b3530d5062c13b68ff3aee7b64feab9459f0c189b7f8908d3e13c95e4a49cef8d00bc0c3b01819d510497119c97ff59ff037cbaebc0f455d131f2d72b6a2b9e46d1902687982fcac9f604e735ad001282618c6a685756e796bee9435b74def4b6e069dd6fbd71c818a9fe00f5b58ce0d1531bc893f9b9c72244e295b973fc4b6a23927f383a8d741822d7034e97ab82246784fec17e113039c77bbab2ec0564e4f53e98dcc699ea71386acc28151cc5e8c0a1e2934a3a2bd71e24a147f100a0a81dc6871a7aa0cbe02c539dad5027dcef17afa0a0ce8b2dac6b38fd12681f9b4e0684053489a1195e91d14b2ce5c200eefc53b61f101ad42b045aad92743b95a178d3d0fee22e56f6018dbc85160c8e61152ead8aae5e0400813228d20d3b875b93eb0c50de0e12e5d91ac0b58ce9f87d3946ccf8034d256092ddb9c518ae4a5aea89fd6064160c8fc97", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xffffffffffffffff, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0xffffffff, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}, 0xa0) getsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000040)=""/28, &(0x7f0000000080)=0x1c) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r5, &(0x7f0000000000)=ANY=[], 0xfffffecc) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x8481, 0x0) ioctl$VFIO_SET_IOMMU(r7, 0x3b66, 0x3) splice(r4, 0x0, r6, 0x0, 0x4ffe2, 0x0) 21:55:25 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:25 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio1\x00', 0x40, 0x0) dup(r1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:25 executing program 2: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) 21:55:25 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, 0x0, 0x4, 0x43, &(0x7f0000ff9000/0x4000)=nil, 0x7f}) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:25 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ashmem\x00', 0x2040, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0xa6, 0xfffffffffffffffd, 0xb, 0x80, @scatter={0xffffffffffffff30, 0x200000, 0x0}, &(0x7f00000000c0)='\x00'/11, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:25 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) 21:55:25 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f00000000c0)=0x6) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000280)={{0x1, 0x2, 0x800, 0x3}, 0x3, 0x7, 'id1\x00', 'timer0\x00', 0x0, 0x2, 0x1, 0x8000, 0x34ec45f4}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffc, 0x12, 0x0, @buffer={0x0, 0xe2, &(0x7f0000000380)=""/226}, &(0x7f0000000180)="dcf2ac5cc844d408790a541f59a59588c65b", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:25 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0xffffffffffffff73, 0x0, @scatter={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/180}, {&(0x7f0000000440)=""/239}, {&(0x7f00000002c0)=""/1}, {&(0x7f0000000540)=""/250}, {&(0x7f0000000640)=""/88}, {&(0x7f00000006c0)=""/204}]}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ashmem\x00', 0x400800, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/sequencer\x00', 0x109000, 0x0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000ac0)={{r3}, 0xfffffffffffffc0a, 0x7, 0x329f}) ioctl$KVM_GET_IRQCHIP(0xffffffffffffffff, 0xc208ae62, &(0x7f0000000840)={0x0, 0x0, @ioapic}) write(r1, &(0x7f00000000c0)="34fbd4b541fc2e13c70c41d402b671b07fc5c550a55b0aa6a4e250f7589db4cde6a8673c060f771cb452e6f6950a7c29cd9f797e3e7b421408278f4182e9dd63bcaa4974a12462ca28bf4ac773d4c0b4703ba9003f3e82587c171a3fccb96ae6d954d013896f3ed6d803ee389e5c6001df690d5231df5ddbd642c3f351e8", 0x7e) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2429.032452] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2429.041332] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2429.047299] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2429.056846] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2429.065783] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 00 00 00 00 00 00 00 00 00 00 00 [ 2429.074707] sd 0:0:1:0: [sg0] tag#2986 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2429.083642] sd 0:0:1:0: [sg0] tag#2986 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2429.092579] sd 0:0:1:0: [sg0] tag#2986 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2429.101503] sd 0:0:1:0: [sg0] tag#2986 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2429.110425] sd 0:0:1:0: [sg0] tag#2986 CDB[70]: 00 00 00 21:55:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000cd5000/0x1000)=nil, &(0x7f0000da1000/0x3000)=nil, &(0x7f0000e99000/0x1000)=nil, &(0x7f00000000c0)="be39759c5e5591d116838f12207c44cf2f8e53ba8e7538226483199e8965ec6b1f56f54bb5ddc4bc3d5b7cfd409de7f2bd22d93664b4282a53d74c0133ca54a236046dbf7de363561d1b9a3c7d75421be3f0bbac179a06a26143170ec4116f8424ac8fa1d73fd89b6fd056dde631babe2fcb76feaa5ae6fd97f7b3c21a87766f1c7bfe5261df4d526f7ad1c3517a84f988134c0080542c29207118434f6fd6947af02a906a62f56b18f069fcbdcca416aa2312ac9bbc4eeeee54719a020f6222ddcdb320d8334aa144e7c0d0c479fd73903a51fc3a5599976590751ff2a26aaf6f6c86b318dc3ef25c", 0xe9, r0}, 0x68) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x10000000000000, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x22) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xa0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x4e23, 0x4f3, @remote, 0xcc49}, {0xa, 0x4e23, 0x2, @mcast2, 0x80000000}, 0x1b, [0x9, 0x7, 0x2, 0xb7d, 0x1, 0x80000000, 0xffffffff, 0x80000001]}, 0x5c) write$P9_RREADLINK(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="0e000000172d51236a5d52ba020005042e2f7875732cff95603e52650faa94c08e410d0496ac9ed1665bba35f8b4be186accfeb8b928497c4bdbb938d350cd56944f5a0b84b3d096c59f82475f30d3e72c1bd1fa5ddfb8949ff494fb38c06c9a1e0d37e20b583d2b529b34c6421cdc1ff4b26d0c291689b7476d799f60ebf394ca7c9fbe11b75cebb8cfaf55ae2b79e2c6ccfff180947b695de4d80e5a602de511f72d3a037bcba081a61b437fcabad7f1e517259752789774b0f19ddb957572d10700395ca5619affda6830ba2086"], 0xe) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x8000}}, 0x102) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000180)=0x3be, 0x4) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0xc39, 0x6, 0x5, 0x2}) 21:55:25 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) [ 2429.262916] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2429.271883] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2429.277821] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2429.286810] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2429.295720] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 [ 2429.390557] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2429.399637] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2429.405578] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2429.414631] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2429.423544] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 21:55:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SIOCRSSCAUSE(r5, 0x89e1, &(0x7f0000000040)=0x990) 21:55:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x5b, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) 21:55:26 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) 21:55:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000001c0)=0x9493) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) fcntl$setsig(r2, 0xa, 0xd) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@dev={0xfe, 0x80, [], 0x3d}, 0x0, 0x0, 0xff, 0xa, 0xfffc, 0x2}, 0x20) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x91, &(0x7f00000000c0)=""/145}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2429.826549] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2429.835408] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2429.841402] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2429.850472] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2429.859413] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 21:55:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0xa}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000001c0)=0x5) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RFLUSH(r3, &(0x7f0000000180)={0x7, 0x6d, 0x2}, 0x7) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2429.938564] sd 0:0:1:0: [sg0] tag#2957 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2429.947337] sd 0:0:1:0: [sg0] tag#2957 CDB: Read Block Limits [ 2429.953373] sd 0:0:1:0: [sg0] tag#2957 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2429.962310] sd 0:0:1:0: [sg0] tag#2957 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2429.971357] sd 0:0:1:0: [sg0] tag#2957 CDB[20]: 9c 09 3f f0 09 21:55:26 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, 0x0) 21:55:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NFNL_MSG_COMPAT_GET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0xb, 0x301, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFTA_COMPAT_NAME={0x7, 0x1, '^[\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20004000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0x52, &(0x7f00000000c0)=""/82}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x2, 0xb81) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) prctl$PR_SET_FP_MODE(0x2d, 0x6) 21:55:26 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) memfd_create(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fdatasync(0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x100000, 0xffffffffffffffff, 0x9}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f00000000c0)) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:26 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x109a00, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:26 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, 0x0) 21:55:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x10030, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:26 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, 0x0) 21:55:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:netlabel_mgmt_exec_t:s0\x00', 0x2a, 0x2) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) fcntl$dupfd(r0, 0x0, r0) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)=[&(0x7f0000000100)='lomime_type\x00', &(0x7f0000000140)='/dev/sg#\x00', &(0x7f0000000180)='{\x00', &(0x7f00000001c0)='/dev/sg#\x00', &(0x7f0000000200)='vmnet0\x00'], &(0x7f0000000300)=[&(0x7f0000000280)='/dev/sg#\x00', &(0x7f00000002c0)='^trusted,/em0\x00']) 21:55:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYRESHEX], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x40, r6, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x60000}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1f}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000}, 0x4004080) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r6, 0x10, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000040) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) fcntl$setpipe(r2, 0x407, 0xffffffffffffffff) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40020d0}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x2c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000880}, 0x105) 21:55:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000240)={{0x0, 0x1, 0xfffff001, 0x1, 0x5}, 0x100, 0x100, 'id0\x00', 'timer0\x00', 0x0, 0xfffffffffffff801, 0x85, 0xfffffffffffffff9, 0x400}) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) ptrace$cont(0x20, r1, 0x0, 0x0) get_robust_list(r1, &(0x7f0000000140)=&(0x7f0000000100)={&(0x7f00000000c0)}, &(0x7f0000000180)=0x18) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='memory.stat\x00', 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000200)={r6, 0xff}, 0x8) 21:55:27 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, &(0x7f0000000600)) 21:55:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) alarm(0xfff) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005040000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r8, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001340)={&(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10, &(0x7f0000002780)=[{&(0x7f0000000100)="ee16cfa19b3c0c03123060d5efcab7208e25ecd40c2383d1b2a0edf0a00e66fe3158dc150462bf95b625575f4a8c8a2d56b464b4c137d7feda7772575df51486cde44e2ed55853db0a347cc23fc2c87b9187c177ea3d225ea279c46c540bb9b0bd5149d3ee3c2eef97eb5b552dd4bb1aeaa7aa3dd8100907433057f2b0bc9d21bb8ad147b21de5fe28dbd5fcd30a7ae9062f1c1242b68eeac3bf23055c4b64853b1a1ebd9ec38c04034c8c3656f5af1297b5b475e771becec63472d3eb211f58cde018b19f51123625029117c77864463f8faee432e4a02ce4af16a6994fdf258ecace5a0950d4480ddf681687feb15a42ccb65c305b7ef1af4447147d8d0f6c12bc4be9bdbc41451e75259985260e3c90137ea3f78d6942184937f08cf721fb37840007cf3076bd64347223b1b596ebcc8a3c12146af831a669b5cedfe817b03aa7c764c6fc6156aa6dd43daf1d4bf65c2988b886baa5461a94dc26ec30ef9f9b82a1d9aa8df428119b9cd96a7c8ca786ded28aae79bc7f1e8cdbc2151af27076692dcf759872b5d400608fcf3842f9b7e9417f7ebea926b0c1dd4686728ee13acb6f22cbd0b3802eb946eb0bd974b27e97b8c79a8aef251d7c5b6b79d7c1d42471c889a9f88c42d691d7c3eb6e6238044b650e0045fbb091afeb025ba677eba68cd994a8c2cda3122380dffec1c4ba2b59aaa5867f568e08439c9dca675e027977d020414cab5dfcb257d6adade091adfe4a5c1eb05cee90daea761958877dfc096d306dda5f11862e3e7e1498725b38e51aeed47815cca8a6f8da614505c570512385aa0cbe8d0797cc26fed6ead804a7c6bddb864e38affaf3969ddad33a0d2cca24f493bdb7777b6accf1a3517ec48756adfd2e5fa7c8ff8b3ce7d07abeff62f3d6ec6d0f72a476ec254e9f474824db1eef074d974d2d4657be85e4be10dd051817d8d19ab45b2d831c094eee2069fb425a60ee2e56faf2269bf7c5893203c76ba703c979861079d2894035f2ab7bceafa199b2ffcf722e83887f898f1ec2d692182ce543238b66abbf0dd6907d1bc39f1c4b37ad90633628dd2a624700d44a164968138359db9579f2927a79f6b72eedb791001a72916e8543f8cc05ad71c6afeaad31e682f021f2b2ef7d9ec70cabeea0150e0644c19cd4d7cdf4be0026063f243ea8c122ac10bd7fd9129f489127ad54e129fe6ed14fac4ab30d43fc954f9083791ccc6dadd49478bdac16634d8bd0c2b25ed5d601ae6bf7c3139f8802c58f25dd73ebc3db3b223df27ebb47483c750841e59eb5db5a44cb0e665081efeb3fe5eb69a341bb028407dbd0da1b3965bd9fd17d18b44837546f4df8ee8aa20ad5ede7551640f196cb9117836c0f10d5521920bf499813ec3be7a332a56815a99e253a0b68d4cfd2bd52c0c2824707045611d6d50cf3e469ac31319bb7ca488ae56aecfeb7db4aaa2134b69f14c5988d11b1d35839a0d63601f3ca544e9e677fb796af1d43f103693171b15a040af8d7d5b02fa8e17731dc244e5866694553e6409662e2b11967427cd29992aee95ad1acc6a39537c96648ae88e6371518c06147efa08c87fa21292659f7939ff0fadfabaf33d60a5c47984badd04529136cbbbc3d9c11705c043f2d808f366ed76e1cb3639ef340946ad4168482f8432c986cc220140073a64da88043a2f83e5429b6a91a6b3aa1523cae9922e1ae0be847048ab2328f349030b30345139e76b312f8b8d21b46fdde3f7dd3b36192426c7104ac3e862f31ee0eff118a86eb7bc9433498a572d159951b279042377ed35f4c201b2ee3708967206886b58020bb20c58be446591a55b1ce714518f93fd2188d0434157b4cdf4919a8c04129bc00ca6d16205149afedb51f87f1b1fa4178c7e18aef019572cc6ddedc9b3124e8e38508f2028bcd1073154f8f1fa735e1938333711a15da27ef125fe03b4102602ecc46ad19d9efbbff1969a76d1e25fc4010b7aaca58e01a58fb7d3a4a3a2b6e0c36bf5a5bd14ba25531f9d916fa744d3795dead41f20c5f16eca52854ef972141d55446c0a34a126e45f5f9f23350e5f4d3a4b939223737a74f27d02756cef711597317c63c100865353f9caac758b2277978a11e9646070ad81a62bac5311dda8ba8e70ced2425e50d4853cb1ff0d66d6bb58319840f15121497a02e6c1312990cc50abfedacfb25d29f74d7d3ae6fab5e2b9b78cc9b6f5a474899025c9c654fe3eddf1d54d4c5e4f23555906374ce2515730b3c5a5cb184bc88dcd9b2737d8880cb379cc6d7a266b1d78a0ecdcddcb22c0fee5def8a85ebbdbf70c4d54749a72b114523ed6e13c8c54960d4059551fe964cfe44c9f732ac02829b181e782a0739e88c5af901c19189d7a189a3a195b45f1dfff1beb4fdbbbd7375abb08d223791668b74e48843297c3553b03b27ac3a01369b356130d10d906e1b53e9c7efd6efb34f696df94293efe7727df89bf70a7e143055634e80646a746c1c39fdc78a95962c05bc89879b75ad30e63cbe754a72f76a0721ed97cb33b5c8966e172e2b96215e9e85beb0684fc230c20f1b1ffae11150bdf27ce08c5685a2b9eb722522bd56e36e9313984e9ac41b4d64eeded1c1e89a1ea48406b3f3f247df174eef9869490cb1ae2cb6469fe3191f113146dcd5a1e7657f37610a86195d408fee89fd78b8f434b609e037b92f0489bd151962342f455a9f3a4d5de26e09a1fdc2951c6bad6d4f8d78e4e8cb89744c1360f1f1e8c4d88ef06ccd2f6f6672d2ad8b851abc52208bbece27120a4d931ce09120a66a0380a14f0c7755885c7095b39b557981af5075251c2fea7637db3a78e607008e9a7da84987513d112a32ada967a72ec9d86f02a005a4b25d438b679087345c6943d71f111c9f74419d021f7e5eff4a9eb9b80e51345cdcc12ca8fce7540c02cf505b81d6bc65008f1fea8690072c786ef9d88dcdfae116cbf22f6a129e9a9f9b5e757ab59a1e7168fc7ee17f81c96a7aa8f58842ca6a14fc46bd67d0eebb5a4dec6390c0c43fcade4011853323cb53a2e060d4117b5d33a9fbf131effe99e7281330c0d02664277f533160252364fd50144d9a2f641f409337fe6c16cbe7ab9076e9c7ac3efda170a86327c090e972bd1f609f6592d27f06fa753fa08a3eb22aabaf0f1644bae4d17b1169642a384cb7b0276e0f62d53d9fe931762a0599ecc57ff3196d58c8326d114ffab2a2ed40e91af476aa0b19db15b2b3d64e3e1b074bc9ca2eb69ec16226d3ef3cf4b3bec6c2f4b8bca755461ca9954e3d462a9801813aef1a3e2341ec4bdd7f92c3d62afbb51fb9c87a185055e8029de2228812ab8c9e4e3bdb4e5f4b8b370e6967d9292f35c86331033c36931f98e3bba0f4cb3b62e5af1676d9969dcac4dc2c7fff19527cac8be84e712c8e8d0e0221a0521dac64f29d5350f207b3b94cb5dca41521563d0c82c4d46974feeb9ba0964f04f525e5ea32f21f35171232da1715bb056450f59c2797f462859d848ac87458066dbe13a485dfd6c69c5898643b042d2987b76a1ee06618f67b7314d504cf7e7e8d6d7cfd0ac6a85cbfb7aba88b2e38c022049932ce8092514194bbe25e635aa494d504c1a9e5e3783a894188856162d358d75a6b5488fcddb0ccafb9f0d0cd155a29c9439507c91fabcf791a2a02d89ca419b1d1af14366e0eb8242717f878cbd7b89633c8024fcc56617f1aaf4649c9b7dc83fca0ef418001bd8f179e9ff09c3592730de7754ea3b1783121b862199f3e6af51af3014bd2b557ca72c1c3808b01e8a2d72e61a5b471bcad77959328cdca8ba53c7f6b4e3208d3a6e9b6c77b3eb4bcb5b286375ff2dbddfb697d2017186e6fceda7375bd89491358f042e7037760b23d582de85c332c63dd9610fb97235a0f9f7478975b34fa46548a952b02c710afcb9bdfb18c7d1dfbc745362af2e37bdd82ca97392ac79c53efa915a1fa206bb27b82fa7abf8ff3b13d1f091ef3431651f565600e78b5f74183b6c825eba1868383097b6bcdb6c28247c02254fb066111d9f0b1a56a9e5c4ab8aa90550872886998a4ea1c6dffa07bca7321ca9b660cc0d38aaa720e68a76b1432f1fe8464d102a54d2a578e02e227907e539352af62f8872bc98fca95c05b0d7f5eff8cb2a1c0a4e43431248dbf00354a04859aaa87b7085c9fa979f50959bf4b59b71c3a78562af4785bbaad7e940ab4521ea1a46ee98418e48a739685fa76df241d14e354d0547df1e94f532613d8351cc1e61cc9dc5fc8407c5989c2b972e0b7b04db5cfbf023cc7c98963e8b39209673a40231d4ebc4d5fb31a007b099768db862ee80961c7b5bcb66f42d9cf2d07bfd1a65e71604fa31aeedc442c773c05946125610229f57a4437d5150e90a5bfbaf64f7258f0a163709361492ad6574c90a1d28874dd0fe4b75a01295507f343d8c9162a76219b67257d6eae945c5d28d77c6e2f3b11827d708dea48f2e8f4999353d2dd3c2b6efad627343ece91e1804e21a8acd92c3c1c3392ae756439753881379b31cb529153f96ba03245e3274c427d5071631debd05fef75d05789746e91a281d316fc53cae4b9dbbc6a0daba95443bbd736e2f76c8d332e240eb61b2e413ebd534d49eb487f3cbb04aaf08699f89c4de8056cb38d2ae530cb4670310873e07e174075fb81a815fb92368e9c49d1e278f4e0d2014384bea6f5de77721488f39e9c58d73c3a2a793fb95532bf70eec2480710aeb87c8b772209a70a0e4c002c847f70a19d6e11a06bd05b621a3beabdbd5f21238b8114fc107e45f21c8e7682844d65f6a7a61ee1219e7d45b108e5d3e981dcf1a496e1e40c6160d17c6747cac085813076e38be842e189759fbcbf7ef45860bf35e965a4def7c0165203d4492809beb21deec29d310abf1ce3068e8aa9249a64f77c70666a40ae0f574917dee35d3237a895426d581d3c6bbb656c160753d6bc4a7d2172bbbee3fa8bfe3ca6f31ecfbd0ec1fb58c8ee801c367a2dcef05e13f22e207aa4c97b05e03b8b1f9347d4a00dc95336a3db3a2405bb8ac0901af76e6a6a74dd62c279264043ef687286e7de65ebe6cdf8542bf0545797329cd7f36dad552d2479cd66cd2e67db31d5df12e36f77f9f8e500e5c31aeac6fd4de1543e72de65389a035383ee6c81752ae1daaede71eb352efd8c87dc5af814a46b8eae2dab645d8e23fb6daa4c70d98c315ae22b94bf85be2939d99cd610c86d2bc3af77abbb1a61fd50712f3559b20ef04c480223a57dc6ed09ce1863e2a4a6d19ce6cd97d448c3c78611b260bccfa4b4204636cb1cf9df15fe9d0c382ec6850e1f6eb4b418232cb64a0630054fb93ef3437e45b721a556b18a4fc47bda1fe453cc4b0cda4153a9cd2d28f554b8b1c9ffbcb0a446278b1ad70f5f2d2c7d086f05abf28bde2842ac7332c398734c2d416431f3c1354e2db91f2d86d1e99733234abdc9d5d1791afc1d63e20b8298d6eff0253d58f5d46adf7e785753c860777ebde57f97fda1de29b04655f4225ea67b6521ca3af4877a332d39e220383e63ee1ec1adb021f5aadb24db04faf1e3ecb241c365ea68d6de9c47792d2d1b3a33229342099ba72036a7c8d144e8e8d63c4dec9c654de5bc5b853159b38c6a1f17706e1270d48437a28e4532fbeaa6d96529f437938e74b6b66a6244cbc3bb468fb8259012ebccad01064175d0197380f9860b8f50e4974000650e3fc0a5ecc4cead965402b32e1cc5834e72a0a2c84f2447ee117f68fb9cdf85b48d4a0bfbe2425bee9a20a821", 0x1000}, {&(0x7f0000001100)="5a851fb777435ceccc37e29a2020959bcab09e7ffee06334943aee3e3f57c1e877022812cf263e26421a7ad796ccd1e2eb9d7f1986b066c64e03176b786f78345b845892dfe7f3bf535df348ea3445b963d44b107fe2eec173d38b35aed2ea3dad53792510a0b1ead5fd269896efedff07142f5b922480c3a6ae70ba188c50ab0315a795084c10133476b28094a005378c8ceb2eaee6241da22b0f43b21d575fd9b5471f0ddf4af84a1df0e1c0b9669f1bcd0f56e3ba7ed0b7a3643ef2d144da66d0ef183395d2c11308bca6aa516c2a401b12a6293ced2549ba06fba0b2a2feb6806ff5ff9fd2bffadf562559ace3b28c1c8a04856d", 0xf6}, {&(0x7f00000013c0)="d5df163d4460a60bc540aac8cb86f67c34d0ecc41a96a3f5f89258e53dc96a0b3bec97b3434d4be5d0e0a3cfb71e5677137fa55fe4ae7273c7c7a3edef0a91f38d265519ea769e0f1392d4d1387a6682fea85d92048a5043bab18410e856f86a46e9d1702de1b9ec276dbf5dac2453f36794c184db8b096a342463bd43c4fba79ed2f811b0eb0a62ea20b2f3691370e9e306658f826cce235a686ff680cbcef8b30db02273c9b57de2800e8d5562893e6d6604ca2c518498bbd67f5d70cd69baf8cd12d76a948b7b20c80139cf6dc0931d8ecc15d16d8b5393fe0a5366b765041ca364c7e1f935fb8404fb7d6589dac2ae07ecb8fb38d457690cd915160f41d16bb4da5dfb3b29e5880731ddea97ea2d776353cdf4aec3ebd788fbf05783ac878e209d9ac521d819c51105d8dfc3d4f95b1f84d8b4a95b8ba575cd679d65b5aa7ac7aec12468fce4136990f31136f9a372f621f2f86f2a2b591f8eb614946800a3a7ca1421fae5d5627129c86cd423304de109f206c8ab698aa76b9fc0e0b98de1a5d41845c4020b9246f489fb6a0615217669c5e293d7a8e103a7635a2f6174014e7fd508b7c7537bed4856e9401f2cecfbf8e4672d2c8ac9f3fff07c17d55ccaa214d6b56afed812e1e6200e5aa366e1906401c4699ca0ab7b5b25ba93146e04d7a659657c71a0fb2907576379ecdbb69d3704cc1886c1e6b2b3e1a1832c05d1f2ba090f5b11899e8919b95f0f5a5ec24c7494c49b56f7f4dfebec5cba4e8d91b6562411ce1494daf0bc91c21997b44435caef07f061f42c6b3a41c6050d8fff56c0367bb25fdbfb9b746d395c5f9501a0205ba5d7f5186f18effde9071ace82893365529e7bf06b04e7593d0b109dd18f6be4abc5f0dd68ba576692d6df5e1ce5944d3f52ad7c492d7623be1758cc0d8605b9c6b837cad33634e3948c5d943b778f543c81a3ea3ab6d5dfddc1b2601d5ee1845f58fa820400fd30ade2aa6515bd6c25c5201954f78850ac15cf0b3cf18c26f062bed433fc759e29e509024139d9a214edcfcb86c05e6fc4382a7df7756a6729c534a0cb096a1f87233272a0e966bfabcd82966842f44008432bc2996bd6bde75b94f3cd5f1ee78a87c8c9522bd524de284f1776bff618bb5a1c4e6c1b5ecb27929c22a892e5432349281db358a8fcace93cebe5f828e9a0cba0c7bc97ec0fbc6f4f0ac9e8d4b08b7d7a2ecb4adcfe1b96cebd7d20a0f5d995d4349131d6562714168a537967f53fddea929ebd6e2a310684dfb5ee6d93372a66d03b7ea1be48f69ade53f11794148874c2d293bb482921c29d4b346329451a8d30cf8a5d6987c366adfd0ac96ce97346c15607e773027f442e5df42ec86a04d112f8461faf73ed7189a3fb6328118cce5cece1c6a46cb565ca677af1ff9a93eb1f24b8a29f84a8c477ad8967c1caf49a9e7e45f43f6fe08d871cb952c109c8425e5f9ce24b26d8fa0c5f5b42e5bc2019888d3b80ad72515a6c05af463ef5e52a2fabe38fd6e948c5efc2f21a1bd34f6e8b5243c2b730a4033d1dd1993ca69d3604d4518fadc8c46ffed298ab098b23f7a699ae51f61e1781d9a953028e109ad7d9f117be70c2b7edc5b15c0b8c5294e461c54788fa67f629aa644335f9b859749fd7d3885e312267780b2128af593c37f6d0923ed839fb5676d9ee6684ce71e80ac473b316ed0116db0c632361124c355bb259bdc3bc263f571902f222aaf483e392e673cb1fc86f2296174c945b41e42f2fdddb6cefc69bedd3d17287e629e49a6973e67f6b24ed2f9d9daed49426f1805a9b47f6db064baeb2635f479e8ba6fabcdd27799fc8db108c1cb6826eeb72a8731d08071147f14f04e8aceefa8b2b557a1962710f30258d697b4e6f23ffe76c688585a4c3b9144bb02061df54fdcc6500bdabec7c6544cf4788f1215fd910d6ed3a103a7b4a5ad840c7d8b44db6e69112706c3851b20a4e39c73a8c15d9642a04c63c9d9911ce6385a775c6e66fe2507d2313af8c0418d13c49865942e07628f77fcf34476e0d4d71330ac97bfa04f38dbca1fb478905205fae9ff20249a0b354a171cfadbcbe94fcac59fcf6e680c68d88afe5d8d2b092d080f731ff958721a10110a4d2a4a7241004ab84bec21120aed19b23638aa4eedfeb65870f5becb72d25bb10a02ec1396301c7f3ee2157c00ab805cfba42b349b97bd049bae54cfd02a3512af8e4f63805bae520873ffe6aee93cd7cf482d1954b6710be7bc8e8183740bece2774fa8d075a7ae8030f1e0b240b240a4c8830c2d517e22bd3ee9c4aabf5fc1acc0aec61889949fae9a2376f72cf8637137657ba3382ad95d5663e73cc931dde89ac1f0ffe7f062f7240080f0e949d25e55e009156a0c3481554fa35943fdb4454904235a3d6862df678e44a79872d98f9b76ce0e61d3d95ed72a09ea2deb2c012c862ae73613daf8dd92292cb131233879a8270f10739ac91da48450e158317db017d15d6067ab08b74345ff5295f41c6391db24639b304c1f6b8e2b2eda9d41fb9007edd467034f9f765b02ae13ca912b70acd9d8663d93f237d0919c87cc1f6f999cc4bab9e7b3d3ec9dfe3756f70f267068d50514e40616c6f2e48caffbc429070a566beeef7e86063528b1ebf29f215a4982ab52e0e0ff49079a76c02ff109837e326345f81b77ae95828d26e9ce3a81a787d3e1cb8e65c4bab8c7bd7977f04c55ba2e071a82001bcb98d2e042d0faf39888b4cee2a2f5aac7094933861def9aab0b2b87f1746e2bafbf23f2c58a9995f89bd95f7e606064fd2858ac2a8e2548faca8bfd28b4cd304b20e0f1604731c179b76aded5288f104275907b0ab4455fe071866ce201b732bc66922c5101bf4d3ba5f5d60bd91019c2bdec45ea7b0d4878ee650022effc5ea459e54e8f15e25da602d7c38727d99abba519bb1e966d14b067af78359c0bfea0b92c9ae5494a78c6a4d42dc9d10c5606ae1f31a4115998c1791fbd60d02738c1dffe3ed6246e77e4f90cc46fe52d4179177472f6057b44e0799f1a91d3066b59a32ac3bbc41c4e1f05ff67d19660377ebfc79fc6681d9e01f32635fa3f7e4c63a3e59f7cc1a509911c2b29eec710819f4f94bfc2ca10a3c41e20534f23a4d65d17cb99e85e90fbb7fc894e45306e32d65f0ef5af86295fae823078fe0883e75c1a20cc2d51f390ec22f5654a7f18b47d0452beda0b0922c151a7cdd6093900112bbf62c960a45e754a7dcafe47515a9bf06446619a05e297790e58b5636764c16b20c5d575e1cb56eac24e6efa19f638c245114fab9c0d34dc16a2cc54ca02c76cd63cf3884e8423c0eb4a314340905f92015e0895611bc6371c7f36711442455934135e17b324cd25045009703bb563f0ba9b80d1c47665b9500003ff6b8854273b4f042176181eb8efdcbe841ae6fcf62ae6e32b6db902c9bfd72bb582fe35a616beaeece8867307181a3c10f67130e043e163a5c8af500cfb1aa864cd45aa413b975ef4146a267f7101443e7cac70d3d7eb8af1d21f2e1b427159bcdef3c55375f8c3da07d0d77273fbf763cd4ea023d79a341d9e495b1a2a0fe75a8ae44d4ff4a59fd4fea1ab76209a70cba3f0195a6f4580b90b4f6990c27f3f6c62f109cfe329c0fb200e7e70c88cb925c8548d2a175b540abedc85e2d7eaf32c3a552729b3b558817d15b4afbafbdb5b650c7857d7d0f138e82f05aa3ddd5be885fcf6f1ce626fc7e2acc1cc0d1848469ae70031af2e8e5b602c133235274ff5ced01f594f39a1632f7a793d8cd737ed9a172d6de249e56136368fce212568ca82cb90299100302d94345dd6f789a8381b89ac44e7cacff885a9ff82b478ea6359c8512f2f2a15c22dada86cc15affc5b6465d2ec4319cda38f4e3c58a02e45a99d64f9b9793afa73ff1151d832417c9f45db38ce34c60d17819d40db86e2b75b030e295c3546be9273f65764418d6f7dc2a33d20fc76fb078c2bfdbd96fce15a20107d4f4579421a4b34be2df07af9d9f395018c592affa4ace80bef9c6854d0d247ebde634ad47abab0f8b58226a1be0b76979e89db061a43e776c6d90f5046b763837caa141a5975d6983753c14ad4321fd5b482ffc65aa8a15c014b27bafab6c42310774947016c706d570942169ec07a2546a8ed53d7064568fe0493bf1e05173f3aad5d223f56a076b185268b96ae25da18799a591496a6b7a562e0acc8a60d2d05835d2731d42cef3d2cde91628bdb90bbabffbda488367086cd54a6b4e0a7d886dc85312f257bdc3924896ff3196dc7a728abf1d6032bac4e4bed99ab82a03da3b92294967eb10fc27e48f21e6e121267726fa2498873c5090ec8da44d867b6f795ebb741aaf3230ed2dae3ab222d4efb08f497630c2de8e6438b48e91649cc611896cb7cb2240f4aae13a528bbd5846582a524b90f6b5399b3f7cf4f02df76e1f7872bf035fb497f6ee5c98f474d0a77d4b5a4cf4f0ee3bf2a4a887ae5ce1d075191b2c6428faee4cddd844043886698c5b7f534caca9eeb063c06bcf03216609c30042532504017bbba4a10e68a95bd4ac1eca430b143538644afeb651d41c03e761883e1b2668829e64a5b38aa2820ee69132af2074f42b22b3b7e63806f8356c131b54c1c0f3ef94b2e4726b786fd2533999497225def90b1329bad1b06d8ab2b85341ce19b25e9ce6f514546eeb94fb9abee3576dd5650257d8ea481050408cf927d230e40dbb90a233fa9ab53f910638e478fe64cc43c188481101be7c736026897745e061a27bf2a8dc44e17012726ad4d1af3ff962d656ea936e431b9ab403897af67cf9426237591f340007258f28eb71c32b9e07b4f40e9a0c59c4ff117d0f0040e3cd43a24247c0fe65a763250365faf4e7e4b4d21ae57872e66c9e29931afe4c3802112a7fa113288d09f3ca24b480ca91719260b0002736a0640d1651b617bc8e89715d118e10a3bd1c4c005d1c0253eb4b2b0e4e1001f5bba9f69356a809a605f5985c8cafbf888c61871a99837fab41b14d1b96a335f66f2345b4773ef350ed3e3161c47e0c188348073043f1cdbd386fd059696155f734c721777ea7f1b25b40935e287086a343db003c6741bb493950d305fbf03e782322f7e4292b4c26c20704eac0c9deed8c30f7328d96bc221ad5108c16bad2d02f1d124bbbd2cfe29b57ede2084ddbc494ba4294d89c00b7570de5c00674ef9a937955d103338ab3f408cba5ffb6216efc1a543897add1eecf47f60820d3ac5dc48730dfecde983bf982d5ef34a692c0c93e96f0653401b375c3319e1f7fdf1a86ac72668928044552885fff09b47507de2dbf675346a705f8812e19d4bfeb02843235673cb1450d422818f3425248885f47f575e69354a394c65968b84ba2e0fe9634976cfcb883accd6ce1bc951bdf4233df647eba3a078615a28c507adfe034972f68c8821cf425bb0e44ff1cebf87933adb2ba1dd876b6766357161ea88dab89372357bc037c3d18e595ea6e6bb6d80576318d72ad6205bb0228047b9b9f4b06e3af95cf54d5d4797207713b1f41cbb418acfaaf2a3dc7f06a45cae295ec14d5473bbcbadce4c5029e8804011f94ca348f9ec57c21ff7037da43fe10c7efeb7f8a7ab20ef3b24071c3f8b10d288dcdd6f9abb4be7dd8355c693cd9d814d5ec63e29a89e03a7ebcc82578e73ea3df11bc2bab520afb3fd36a4d540d93c0decccd4f2c6663879ac33c33706195be40b9f76738dd27b62cf1f70a33d8cac52ef4fd619880e4ef8ca5a5e0d919cb643ffae26", 0x1000}, {&(0x7f0000001200)="db749f54f3e2ce1d3cbbc435f5a211a8676b8810772b41a712e8d0c80977c84cae5f83f40b95c64f112a7a27fd6f46ab3c3ee7c4ec2eff6c5a734ff32a3d0b6d757553d7a347c491054cada2db9ed6070c38a90472cc69610941ed7424737a1538c8d45b4c2db68d7324408ed2b9754fc51758e5b5e82c64195d9c72501be7d67f41635a8089a88427942b7c228a8ba01a2f3f685129b0dccfe4410d2a208117e311e97610deaa383ed47aae022b57e74a10930234e617aa59ca9902ef8cb3", 0xbf}, {&(0x7f00000012c0)="18c92983bfdd6c93758779d3edeecbeef489f104d1a2f02bcf92105d6ca384256e2c93454440de372d7eac744177563afbfc7e64eda6b9b9e6d8bfdd6dc92a8655fe7340048e8d5fadc7d58e981503319d2454e47d166dba9d9f2b6bd77c19c6f49bf214773f573a2cf31e7d43dd9d8382048440baead897", 0x78}, {&(0x7f00000023c0)="5cd97bf6758a4c5b77b3ba9b695db23ca10cd7f5b04129a6bf11154ffa70ea98228a79a8859a032c37d417600c8a606bb0fc9be47a2385409c1f854dfab87b69fd5a53d7307fbe1b264a16edf41630e48697a80e4313f2b3de308e3f941583df3a61b6763b8bf08ad2716996c495b048237d76654158809788f15b2d5a90", 0x7e}, {&(0x7f0000002440)="d64a8b269099a6909541091b17ee76ab586138f6c842b2a9c3d1d7b937bd80652ab00dc2f2712e30e5dd20eee2c739bc7e5cdea82d8b6b1f5617c9bb159c1967c02854da90c2904c016ef4177f2502687b70711553d75602b4eecc7e7b70818bae48c9016742f994bdba245a877192f1d110f5c6f9b7d2f82ed22462d9a267ab50be3f6da3f2a7c2cd673dc7e6f513076a2874c0d0e859ec146afd9a1883b8d260e84b9405350c74dc4dd0132f658ca9cbf1e53095112f6edee6ff30d494d733fdabfa686f2f1a06ec30b0c722b6ebafa8", 0xd1}, {&(0x7f0000002540)="f56bed1a93a48a3de7406df0f30d1d611bb63a777035daec36f021b6416def203ffdbdf4337aab8338b923c239b53e399da4ae4d1564806de86375ad209b61e30c4682d2f5ae9ea68e68095e82d7a29c5048cb5a2dea66033559470c0645df4d2a449ade0db4c262fc0de7bbd4616dc81f3e69165894ec446a17c8704f0a39e7dcc4a8a8f65b388d1a6eb2b6d125e889de7c5b15e021824105f4436e797936bd8b5946ca37aee6f3ec98cffe94553664f28dfd17390d0a51e18516a822a7", 0xbe}, {&(0x7f0000002600)="21579569862024a0a6d380d094afc9bf44295e7ba2c9aa61ed1151e86419e9b959198a8b4a086eb35bd06426e4b7d9cc8826a6ad35202c24f3111b119a2e7c6df36fd5f1c4c7cfc1a112c42b9e0d1b0b50e3a0d42e0de7f024e17ac7e8bd5f8bc1754b8dbf304ad7cf12", 0x6a}, {&(0x7f0000002680)="f289236c34910b938736e3a469205e1e3062bedd41cdd3635f38e95160d000f8cce0a2276ccce9e3a2b5d673eea006911ab68e0327fbe86c7f7b861593a9c27d806b3db5160b48a37858124431653139a3c548b6c65a7185ef7c01a2e99ebbda31ca8182553de90077507c901a0a17091bb0cb90251fe7b7dab9fe86596e1f873c282fb9892ca8579dc8ba26544d5b73fe64ef5eac532e03c920edfaedd7d1778189fdfa6d58045d9e9f49a20e4ff042aa02a11646dd4c4720441ae379c099b165812cb3edd744afa58fdf454ca1741caab0909e815579d198face8b9f62d95008d16f14b53c3d2e8c", 0xe9}], 0xa, &(0x7f0000002840)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0x80000000}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @remote, @rand_addr=0x64010102}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_retopts={{0x50, 0x0, 0x7, {[@timestamp={0x44, 0x20, 0xc3, 0x0, 0x4, [0x80, 0x1, 0x3, 0x5, 0x5, 0x80000001, 0x8001]}, @generic={0x83, 0x12, "a06fe2c8f148fcaf9c5850e4d690672a"}, @rr={0x7, 0xb, 0x44, [@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback]}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x80000001}}, @ip_retopts={{0x54, 0x0, 0x7, {[@cipso={0x86, 0x43, 0x0, [{0x0, 0x2}, {0x1, 0x3, '\r'}, {0xe6a0a2022dbc484b, 0xa, "f5cdc5027fcdda50"}, {0x2, 0x9, "1cedef153171be"}, {0x1, 0xe, "f1f4a4cbd0693848cdcc361b"}, {0x2, 0xb, "311d1872d28ef16793"}, {0x6, 0xc, "18b0eac753f2b8d023fa"}]}, @noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @dev={0xac, 0x14, 0x14, 0x40}, @multicast1}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0x160}, 0x2000c084) 21:55:27 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x200000, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) fchmodat(r0, &(0x7f0000000100)='./file0\x00', 0x181) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) link(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') 21:55:27 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, &(0x7f0000000600)) 21:55:27 executing program 1: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x400000, 0x0) ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0) syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x10001, 0x400) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SG_SCSI_RESET(0xffffffffffffffff, 0x2284, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x0, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) setxattr$trusted_overlay_nlink(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'U+', 0x2}, 0x16, 0x2) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) ptrace$getsig(0x4202, r3, 0x20, &(0x7f0000000380)) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3}}, 0xa0) ioctl$TIOCGISO7816(r2, 0x80285442, &(0x7f00000000c0)) 21:55:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2431.286159] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2431.295100] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2431.301132] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2431.310085] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2431.319012] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 21:55:27 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, &(0x7f0000000600)) 21:55:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x60) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000100)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r2, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@SEG6_ATTR_DST={0x14, 0x1, @local}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x7f}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004840}, 0x4004) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x200, 0x0) linkat(r3, &(0x7f00000002c0)='./bus\x00', r1, &(0x7f0000000300)='./bus\x00', 0x0) 21:55:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f00000000c0)={'icmp6\x00'}, &(0x7f0000000100)=0x1e) 21:55:27 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f00000000c0)=0xffffff8c) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x40, 0x9f9071e730cb73e5) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:27 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[0x0]) 21:55:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockname$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) 21:55:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012850a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000000eb", @ANYRES16=0x0, @ANYBLOB="00022abd7000ffdbdf251000000008003200070000000500350009000000050037000000000005003500e1000000050035008100000008002b0005000000"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20000844) r2 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x0, @ipv4}, &(0x7f0000000100)=0x80, 0x800) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r4 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f00000004c0)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) write$binfmt_misc(r4, &(0x7f00000002c0)=ANY=[@ANYRESOCT=r5, @ANYRESOCT=r2, @ANYRES64=r6, @ANYRES16, @ANYRESDEC], 0xffffff07) splice(r0, 0x0, r1, 0x0, 0x4ffe2, 0x0) 21:55:28 executing program 2: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x8000, 0x0) ioctl$SNDCTL_DSP_SETDUPLEX(r0, 0x5016, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10000, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)='\x00\x00\x00\x00\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:28 executing program 1: ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:28 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[0x0]) 21:55:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x2f6f00, 0x0) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000180)) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000140)=0x14) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) 21:55:28 executing program 2: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x3023, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0xa0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0xe, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="590000000000000000009500c65b", 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f0000000180)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x1) 21:55:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x1, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000140)={0x9f0000, 0x200, 0x1ff, r0, 0x0, &(0x7f0000000100)={0x9f00c8, 0x4, [], @p_u16=&(0x7f00000000c0)=0x5}}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NFT_MSG_GETSET(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x4c, 0xa, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0xa}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x4}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0xe6}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x11) 21:55:28 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[0x0]) 21:55:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x1}, 0x0, 0x0, 0x0, 0xffffffffffff8001, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x5}}, 0xa0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f00000001c0)={0x19, 0xe6, &(0x7f00000000c0)="cdd6c26f70d0bf695c0980443d48dd070679d8cca293fa1810e7c5ab67debb81a3cdbc56ae0563a19fb099285b9e1854dde6bbd25cf47b52131d166477420268e5f9ec9a5593ab8404eaed49530b0438017d3654717e338d6e9edeeee4eab1983361c6bfe88a971225aea3544b823647e8c4adf37c881e8edc94dd95bd0622c35f3082825680c7d104f208514f08da6fad3104ee278be2780a70f07fcb2ba566da68d0add25f804b0d54a2573326b3569e6a8ffa8a4140fc7b14e4c3b76835ea1e913b99b4472fb4fe76ee51162db67cc0fb06b3c4c30846e12b472007e791df643f4c5472ef"}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x40800, 0x0) fcntl$dupfd(r0, 0x0, r1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:28 executing program 1: ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000000c0)=0x2, 0x4) 21:55:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x1, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fcntl$getownex(r2, 0x10, &(0x7f0000000440)) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) write$binfmt_misc(r1, &(0x7f0000000280)={'syz1', "e7abe8ec2ff415c72ac969c51656b33fb64f6015f5333ee971a389e91750498af71c32904c865aba97213a4548c9657ae6a50156486140021b1b33095f4e98488f5fe5993376fcb264880ecba14a6310d52f401f8d65408d3cb5611f7bcc5101e1b4671ee1c7fe069732d6d7560ce37bc58563710fd79f6a26cc663e00bd1a015b9d728d236b902a8ea2305cc9777017ddd8ef259e0fed9ca2e047cacc50124d3831ce9a5e6ad0a39d2e2a818b3bc62a00366cb3bdaf49498b912b8234c391c2777786502c175fe441a0a1f63c49891abe4733cd4cd1611287db7d"}, 0xffffffffffffff5f) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) read$midi(r3, &(0x7f00000000c0)=""/216, 0xd8) r4 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x1, 0x201) ioctl$EVIOCGID(r4, 0x80084502, &(0x7f0000000380)=""/140) [ 2432.629018] scsi_io_completion: 7 callbacks suppressed [ 2432.629055] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2432.643257] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2432.649267] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2432.658228] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2432.667111] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 [ 2432.682766] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2432.691754] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2432.697684] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2432.706640] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2432.715551] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 21:55:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:29 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:29 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000002c0)=0x0) sched_getscheduler(r2) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x129040, 0x0) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f00000002c0)='wireguard\x00') sendmsg$WG_CMD_GET_DEVICE(r4, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000128bd7000fcdbdf250000000008000500000000000800050000000000080007000600000014000200040000000000000000000000001100000068652e9701ca7e0b5471db702fb2f7585d58c19870071f6af41ecd42e7cb3d349d402624f609514dfd0340e43f91421be7a3547242a90d000065e69c19e700e008d3584722d2eef5a6de55e5876b338d"], 0x40}, 0x1, 0x0, 0x0, 0x20000881}, 0x30048040) sendmsg$WG_CMD_GET_DEVICE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r5, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000005}, 0x40480c4) ptrace$cont(0x20, r1, 0x0, 0x0) r6 = syz_open_procfs(r1, &(0x7f00000000c0)='net/ip6_flowlabel\x00') ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000100)={0xa, 0x0, [{0x40000000, 0xaac, 0x2, 0xfffffffa, 0x80000001, 0x0, 0x96}, {0x0, 0x778e, 0x0, 0xfffffffc, 0x1, 0x1, 0x7}, {0xa, 0xfffffff8, 0x2, 0xf3f, 0xb86f, 0xfff}, {0x1, 0x6, 0x4, 0xfff, 0x1, 0x3, 0x8}, {0xc0000000, 0x3, 0x4, 0x8, 0x8, 0x6, 0x73}, {0x7, 0x2, 0x0, 0x5, 0xffffff70, 0x7, 0x6131}, {0x2, 0xfffffffd, 0x7, 0x6, 0x1, 0x6, 0x5}, {0x40000001, 0x0, 0x0, 0x9, 0x9, 0x2, 0x78d8dd19}, {0xa, 0x6, 0x5, 0x1, 0x3, 0x5aa, 0x5}, {0x7, 0xff, 0x4, 0x9, 0x307, 0x9, 0x18000000}]}) 21:55:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x9b, 0x0, @scatter={0x7, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)=""/47, 0x2f}, {&(0x7f0000000200)=""/171, 0xab}, {&(0x7f00000002c0)=""/101, 0x65}, {&(0x7f0000000340)=""/204, 0xcc}, {&(0x7f0000000440)}, {&(0x7f0000000480)=""/59, 0x3b}, {&(0x7f00000004c0)}]}, &(0x7f0000000100)="182fccf40d06e339bd7e8b0d86f40425813a3cf0cf0e05fb0cc8cd66dbc107a54943d07153f58b44084811e10cddb166cf2358fc1afcfea71510c713a9463f837eb0dee93497b7c1fca20749f2b3fe1811e10fe10366c842256b46353050a482a454cf0ca5f87ca1196bc43110595aaf2be1418306add1aac19c13bc82132f4f5a0ee594bd92a96062edb6c1982faf0e8bd89105da3097e1fe8293", 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:29 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000280)) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000100)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f00000000c0)=[{}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) accept4(r3, 0x0, &(0x7f0000000200), 0x40000) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:29 executing program 0: connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@rose, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @bcast, @rose, @null]}, 0x48) syz_open_dev$ptys(0xc, 0x3, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}, 0xa0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)={0x14, r5, 0x1}, 0x14}}, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000300)={{0x2, 0x4e24, @loopback}, {0x6, @local}, 0x12, {0x2, 0x4e22, @loopback}, 'tunl0\x00'}) sendmsg$TIPC_NL_BEARER_GET(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x6c, r5, 0x400, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x34, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x10001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x20}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x48004}, 0x20000040) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_SET_MASTER(0xffffffffffffffff, 0x641e) ioctl$VFIO_CHECK_EXTENSION(r1, 0x3b65, 0x7) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000000)=0xb2, &(0x7f0000000040)=0x4) [ 2432.824609] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2432.833482] sd 0:0:1:0: [sg0] tag#2959 CDB: Copy [ 2432.838345] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 18 2f cc f4 0d 06 e3 39 bd 7e 8b 0d 86 f4 04 25 [ 2432.847220] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 81 3a 3c f0 cf 0e 05 fb 0c c8 cd 66 db c1 07 a5 [ 2432.856199] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 49 43 d0 71 53 f5 8b 44 08 48 11 e1 0c dd b1 66 [ 2432.865116] sd 0:0:1:0: [sg0] tag#2959 CDB[30]: cf 23 58 fc 1a fc fe a7 15 10 c7 13 a9 46 3f 83 [ 2432.874123] sd 0:0:1:0: [sg0] tag#2959 CDB[40]: 7e b0 de e9 34 97 b7 c1 fc a2 07 49 f2 b3 fe 18 [ 2432.883035] sd 0:0:1:0: [sg0] tag#2959 CDB[50]: 11 e1 0f e1 03 66 c8 42 25 6b 46 35 30 50 a4 82 [ 2432.892012] sd 0:0:1:0: [sg0] tag#2959 CDB[60]: a4 54 cf 0c a5 f8 7c a1 19 6b c4 31 10 59 5a af [ 2432.900940] sd 0:0:1:0: [sg0] tag#2959 CDB[70]: 2b e1 41 83 06 ad d1 aa c1 9c 13 bc 82 13 2f 4f [ 2432.909908] sd 0:0:1:0: [sg0] tag#2959 CDB[80]: 5a 0e e5 94 bd 92 a9 60 62 ed b6 c1 98 2f af 0e 21:55:29 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f00000001c0)={0x9f0000, 0xfffffff9, 0x3d6, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x990afa, 0xf6400000, [], @string=&(0x7f0000000040)=0xe1}}) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000000)='selinux@$mime_type^\x00') connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @bcast, @rose, @rose, @null]}, 0x48) bind$netrom(r0, 0x0, 0x0) [ 2432.918840] sd 0:0:1:0: [sg0] tag#2959 CDB[90]: 8b d8 91 05 da 30 97 e1 fe 82 93 21:55:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) setxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.sockprotoname\x00', &(0x7f0000000140)='/dev/sg#\x00', 0x9, 0x3) 21:55:29 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x103000, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x3, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)=""/106, 0x6a}, {&(0x7f0000000200)=""/182, 0xb6}, {&(0x7f00000002c0)=""/89, 0x59}]}, &(0x7f0000000100)="59a59588c65b", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:29 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x96, &(0x7f0000000100)=""/150}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$BLKDISCARD(0xffffffffffffffff, 0x1277, &(0x7f00000000c0)=0x7) [ 2433.066710] selinux_nlmsg_perm: 316 callbacks suppressed [ 2433.066719] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.097464] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 21:55:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x10000, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) open(&(0x7f0000000200)='./bus\x00', 0x20000, 0x2) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @local}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000100)={r6, 0x100, 0x0, 0x3}, &(0x7f0000000140)=0x18) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000180)={r7}, &(0x7f00000001c0)=0x8) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f00000002c0)={0x4, &(0x7f0000000280)=[{}, {}, {}, {}]}) [ 2433.110485] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.124870] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.164390] audit: type=1804 audit(1588542929.423:1185): pid=14311 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir896473057/syzkaller.MHPaIO/4036/bus" dev="sda1" ino=17601 res=1 [ 2433.193256] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.215105] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.228857] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.241440] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 [ 2433.255784] audit: type=1804 audit(1588542929.513:1186): pid=14313 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir896473057/syzkaller.MHPaIO/4036/bus" dev="sda1" ino=17601 res=1 [ 2433.302766] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 21:55:29 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom, @bcast, @rose, @rose, @null]}, 0x48) bind$netrom(r0, 0x0, 0x0) [ 2433.315537] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14303 comm=syz-executor.3 21:55:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) lookup_dcookie(0x80, &(0x7f00000000c0)=""/4096, 0x1000) 21:55:30 executing program 2: ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r2, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfe, 0x440002}, 0xc, &(0x7f00000000c0), 0x0, &(0x7f0000000400)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, r0, r2}}}, @cred={{0x1c, 0x1, 0x2, {r3, r5, r7}}}], 0xd0, 0x800}, 0x20000814) 21:55:30 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:30 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r0, 0x0, 0x0) 21:55:30 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0xf0, &(0x7f0000000380)=""/240}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) r2 = getpid() prctl$PR_SET_PTRACER(0x59616d61, r2) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000180)="45e9aed12f060000000000000025d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc00000000000000000000000000000068e9d3a60a6638d888e6b924fa38e50ac9a54e6717be51823a60c823ae54f0f62e726a997709e4f607e04587cc1e6ffdd38bac11ef386a6345c45249749969439ffd339708a8db36eff87d320034e4acdb77ad04e6071c248ecaba793a4f7c1b09632388cd8558c93fba01c0f3736bb72ca1e78542e11f939f0265c321aba72a56c8", 0xca}], 0x4, 0x2) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYRESDEC, @ANYRESOCT, @ANYBLOB="c63b6c38d75423a3a68958e4b634e94e929502651192e1860ffa46707477fb3821eb650b38d8a6dd1f4c13fda8243c9dd14f51898d9bc9406351efce5aeea5ba2dd1a669c34ad1cc0ad4c6355bc3de25c4c65081904d59dae0c3"], 0x85}, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) r4 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) 21:55:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x1000001000, 0x355040) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000040)="59a59588c65b", 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:30 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @bcast, @rose, @rose, @null]}, 0x48) bind$netrom(r0, 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000180)=0x8) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}}, 0xa0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f0000000000)={0x2, 'Iv'}, 0x3) 21:55:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0xffc, &(0x7f0000000140)=""/4092}, &(0x7f0000001380)="7904c5405a00", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x4}, 0x68) [ 2434.002433] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2434.011262] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2434.017201] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2434.026208] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2434.035131] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 21:55:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$sock_buf(r2, 0x1, 0x1f, &(0x7f0000000380)=""/192, &(0x7f0000000100)=0xc0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r2, 0x10f, 0x84, &(0x7f00000002c0), &(0x7f0000000300)=0x4) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2434.228837] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2434.237949] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2434.243874] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2434.253377] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2434.262292] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 21:55:30 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000010}, 0x40000d4) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) connect$netrom(r3, &(0x7f0000000080)={{0x6, @rose, 0x6}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @rose, @rose, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) bind$netrom(r2, 0x0, 0x0) 21:55:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x12, 0x2, @buffer={0x0, 0xa, &(0x7f0000000100)=""/10}, &(0x7f00000000c0)="59a5ff030000b329008be5d56ce7bc7e3477", 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = add_key$keyring(&(0x7f0000000600)='keyring\x00', &(0x7f0000000640)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x4c40, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000400)={&(0x7f00000003c0)=[0x101, 0x62f6, 0x0], 0x3, 0x8, 0x7, 0x8, 0x1000, 0x7ff, 0x400, {0x5, 0x0, 0x9, 0x5, 0x800, 0x6, 0x4, 0x2, 0x1, 0x45bf, 0x1ff, 0x3ff, 0xd3d0, 0x4, "34130130e66d9c25c5cb9c49f40e8b4b97d411650c8196e1b0474efe0d5fb0e9"}}) r4 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r1) r5 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) fsetxattr$trusted_overlay_opaque(r5, &(0x7f0000000480)='trusted.overlay.opaque\x00', &(0x7f00000004c0)='y\x00', 0x2, 0x2) r6 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000900)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228897501f93191b076ac446ff0022b8753a1fa74ff569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23", 0x395, r4) r7 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r7, r6, r7}, &(0x7f0000000700)=""/243, 0xf3, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x02\x00\x00\x00\x0f\x00@\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, &(0x7f0000000240)="8f88866fa3db71a0fcf5b5e60953c97992006e2002fdcdd4e2296a64740760779eba52ba9fb872af283389433cc2cd020052333d30c13c1310fb1bd4f398da85028f575007f9dd6190e8add1cfbc5790ac988a60190e0218b8d5905ed74bf243dfbe3e486d5300dd9b4adebbb9e8dae1104c6336b108a9f6c7effc78432695b0773ee3227457bf74a363eb9323f184c1874aaf79583d76cdef67b1adbf80a1ef9b3157d60dd57cacec990516baa3a24653533cb3d61ae8da49ed12484197a4616db26d28c7c18346ebd4d742564df9f785200000000000000040c5b69820c79fc24d6174ec26bb697e1236eb8774004193c0765e8d2a4cde339c1c9f98b19850fb42f4cbfbf46727a8c6f9252ed0c0a1f1a2", 0x112}) r8 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r8) keyctl$instantiate_iov(0x14, r6, &(0x7f0000000180)=[{&(0x7f0000000140)}], 0x1, r8) [ 2434.504853] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2434.513851] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2434.519845] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2434.528796] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2434.537681] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 [ 2434.556516] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2434.565365] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2434.571423] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2434.580457] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2434.589420] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 21:55:31 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:31 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose, 0x2}, [@rose, @rose, @default, @bcast, @bcast, @rose, @rose, @null]}, 0x48) bind$netrom(r0, 0x0, 0x0) 21:55:31 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = fcntl$dupfd(r0, 0x0, r1) r3 = geteuid() r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r5, 0x0, 0x0) fchownat(r2, &(0x7f0000000180)='./bus\x00', r3, r5, 0x100) r6 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) write$FUSE_OPEN(r7, &(0x7f00000000c0)={0x20, 0x0, 0x5, {0x0, 0x7}}, 0x20) 21:55:31 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:31 executing program 1: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="400000000e14080025bd7000fbdbdf25080003000100000008003c000200000008003c00030000000800010000000000080001000200000008003c000500000038c1dcbe18433b939aaba2b14e0a1248f2ee426d286b2231416552071bc5146b8879bbd1fc6c4e4564a791c25f55fee6fb6df14f30ae054af215a145ccb7fcd1e0f2"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)={0x150, 0x1403, 0x2, 0x70bd2b, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond_slave_0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'rose0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'gre0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'tunl0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'team0\x00'}}]}, 0x150}, 0x1, 0x0, 0x0, 0x41}, 0x44880) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000080)=0x1) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000040)) 21:55:33 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, 0xffffffffffffffff, &(0x7f0000000040), 0xff66}]) 21:55:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0x1000, &(0x7f00000000c0)=""/4096}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:33 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@rose, @default, @default, @null, @bcast, @rose, @rose, @null]}, 0x48) bind$netrom(r0, 0x0, 0x0) 21:55:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) splice(r2, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f00000000c0)={0x7, [0x7, 0x7, 0x1, 0x2, 0xff01, 0x401, 0x2e35]}, 0x12) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f0000000180)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f00000001c0)={0x0}) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000200)={r4, 0x80000, r5}) 21:55:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f00000000c0)={'netpci0\x00', 0x383}) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a500000000", 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:33 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, 0xffffffffffffffff, &(0x7f0000000040), 0xff66}]) 21:55:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) getsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f0000000100)=0x400, &(0x7f0000000140)=0x4) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f0000000180)={0x1, 0x0, {0x0, 0x6, 0x1007, 0x4, 0x6, 0x6, 0x1, 0x7}}) 21:55:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x202302, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000100)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f00000000c0)=0x2, 0x4) 21:55:33 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, 0xffffffffffffffff, &(0x7f0000000040), 0xff66}]) 21:55:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r5, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="77e95d73cf6135ffd05b9ddf67b0973548c65ef858abf8c39c2889d4fbe0bc6ae30ebf6992239aa8618dfc90331a0e143fc1e21a8c10edbb301dac16c68ba3d10d1b1aa1599c8668a7a226d5cadc9d8dd3126cf2ee831ff3f1df8c4a0096c936f82101c0cd5000771d9ce1bce207301500f435581d11cd547d4113625727dfb4f3f4574f96b1a8dd7dc9b70c0b6492a5b1c608ca111c01326ad662cf74aba2a2495d506da535a6b01bb9815300defd97fcec251083af02b15a18dc4221a1b4c1c59be15c1434ca1c9ee55da18e5fefcd03fe89d692464f7c3f86d6ccbb5d29fc9d8178ad5c67a008bbbc39fb237fb542152d4e910306074aebc0"], 0x48}}, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="3a0000e4240007050000024007a2a34005a314202a05507e4a99", @ANYRES32=r6, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="340001022cf6260d000000000000f0fc8b8f918ed87d587eed4266a10b000000070000e54b80496d056a3d554ba3e67de3ee9a0c3a489ce2c6539bd7616f72ee2c", @ANYRES32=r5, @ANYBLOB="f3ff0000000000000800000009000100727376700000000004000200"], 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'veth1_to_hsr\x00', r5}) r7 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000140)={0x0, 0xff, 0x0, r7, 0x0, &(0x7f0000000100)={0xa70931, 0x4, [], @string=&(0x7f00000000c0)=0xdc}}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000000180)={{0x20, 0x5}, {0x5, 0x20}, 0x6, 0x0, 0xb}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000380)='/dev/nullb0\x00', 0x400440, 0x0) 21:55:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00') ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2437.531101] device veth156 entered promiscuous mode 21:55:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x73, &(0x7f00000000c0)=""/115}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) userfaultfd(0x800) [ 2437.567121] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2437.576050] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2437.582042] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2437.590969] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2437.599904] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 [ 2437.623242] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2437.632240] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2437.638224] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2437.647096] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2437.656010] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:33 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) [ 2437.806714] device veth156 entered promiscuous mode 21:55:34 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) splice(r2, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x200480) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000200)={'syzkaller1\x00', 0x7}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0x5, 0x6, 0x0, @buffer={0x0, 0x7b, &(0x7f0000000180)=""/123}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x80000, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000400)) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000140)={0x1, 0x0, &(0x7f0000000100)=[0x0]}) r4 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x6, 0x22b02) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300)='nl80211\x00') r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r9, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r9, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x2c, r5, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL80211_ATTR_IFTYPE={0x8}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r9}]}, 0x2c}}, 0x4000) 21:55:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x40, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x1}}, 0xa0) fgetxattr(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB='ev/sg#\x00'], &(0x7f0000000100)=""/69, 0x45) 21:55:34 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) 21:55:34 executing program 2: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0xfffffffffffffffe, 0x4c0681) 21:55:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f00000002c0)={0xfff, 0x100, "d1ae852e078d50596a80d96e1fc3a566b398a3402ea017c24b14c3a52fa0e986", 0x101, 0x80, 0x63, 0xfffff4d5, 0x43}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) write$input_event(r3, &(0x7f00000000c0)={{}, 0x4, 0x5238, 0xa0}, 0x18) 21:55:34 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) 21:55:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r3, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x880000, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno'}, 0x2c, {[{@dfltgid={'dfltgid', 0x3d, r3}}, {@cache_mmap='cache=mmap'}, {@access_any='access=any'}, {@version_u='version=9p2000.u'}], [{@obj_type={'obj_type', 0x3d, '/dev/sg#\x00'}}]}}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2438.152488] sd 0:0:1:0: [sg0] tag#2959 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2438.161329] sd 0:0:1:0: [sg0] tag#2959 CDB: Read Block Limits [ 2438.167258] sd 0:0:1:0: [sg0] tag#2959 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2438.176343] sd 0:0:1:0: [sg0] tag#2959 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2438.185269] sd 0:0:1:0: [sg0] tag#2959 CDB[20]: 9c 09 3f f0 09 [ 2438.274894] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2438.283877] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2438.289887] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2438.298817] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2438.307751] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x40, 0x0) 21:55:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) nanosleep(&(0x7f0000000180)={0x0, 0x3938700}, &(0x7f00000001c0)) creat(&(0x7f0000000200)='./bus\x00', 0x20) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_S_MODULATOR(r1, 0x40445637, &(0x7f00000000c0)={0x8, "18e2e828738de220743377290a848f0039b56b0d839ef247cbc95dc1c264b018", 0x8, 0x0, 0x40, 0x0, 0x3}) 21:55:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f00000000c0)={0xb, {0x81, 0x3f, 0x7ff, 0x3f}}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:34 executing program 5 (fault-call:3 fault-nth:0): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2438.569391] FAULT_INJECTION: forcing a failure. [ 2438.569391] name failslab, interval 1, probability 0, space 0, times 0 [ 2438.593024] CPU: 0 PID: 14537 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2438.600928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2438.610324] Call Trace: [ 2438.612932] dump_stack+0x13e/0x194 [ 2438.616571] should_fail.cold+0x10a/0x14b [ 2438.620732] should_failslab+0xd6/0x130 [ 2438.624711] kmem_cache_alloc+0x2b5/0x770 [ 2438.628872] ? trace_hardirqs_on_caller+0x3f6/0x590 [ 2438.633889] ? get_reqs_available+0x225/0x3d0 [ 2438.638389] do_io_submit+0x2c4/0x13f0 [ 2438.642292] ? free_ioctx_users+0x3d0/0x3d0 [ 2438.646622] ? vfs_write+0xff/0x4e0 [ 2438.650254] ? SyS_read+0x210/0x210 [ 2438.653885] ? SyS_clock_settime+0x1a0/0x1a0 [ 2438.658295] ? SyS_io_destroy+0x300/0x300 [ 2438.662445] ? do_syscall_64+0x1d5/0x640 [ 2438.666506] do_syscall_64+0x1d5/0x640 [ 2438.670403] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2438.675591] RIP: 0033:0x45c829 [ 2438.678784] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2438.686492] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2438.693760] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2438.701029] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2438.708294] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 21:55:34 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) splice(r2, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x800000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x103800) r1 = semget(0x3, 0x4, 0x80) semctl$SEM_STAT(r1, 0x3, 0x12, &(0x7f00000000c0)=""/117) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000280)=ANY=[@ANYBLOB="377120f03232c2f2fcb61c2aa98c473b7a90bb5e7028eeddac342ccea075335e9f000045b960d20000000000000001", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) r6 = dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r6, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a78daf1645f08113e6c4f4048f1104d17ec25ad2201d1f03dbcd5586fce7da946563807", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000140)={r3, 0x80010, 0x20, 0x6, 0x0, 0x6ecb, 0x54, 0x877, {r7, @in={{0x2, 0x4e21, @rand_addr=0x64010101}}, 0x7f, 0x9, 0x5, 0x2, 0x1f}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000240)=@assoc_value={r8, 0x742}, 0x8) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2438.715559] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x39, 0xfd, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000100)="59a59588c65bc4a1eb882c00b0f25fe41b85db262323d33c5c9ace56e85e1bf85b6d67fa3af6c9e4f037a69c77fa1ed42113b6b587356936d9", 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0)='nbd\x00') 21:55:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000000c0)={0x18, 0x0, {0x3, @dev={[], 0x2d}, 'caif0\x00'}}) msgget$private(0x0, 0x4c8) 21:55:35 executing program 5 (fault-call:3 fault-nth:1): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2439.042999] FAULT_INJECTION: forcing a failure. [ 2439.042999] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2439.054833] CPU: 1 PID: 14563 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2439.062714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2439.072068] Call Trace: [ 2439.074660] dump_stack+0x13e/0x194 [ 2439.078296] should_fail.cold+0x10a/0x14b [ 2439.082450] __alloc_pages_nodemask+0x1bf/0x700 [ 2439.087132] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2439.092153] ? find_held_lock+0x2d/0x110 [ 2439.096232] cache_grow_begin+0x7b/0x410 [ 2439.100302] kmem_cache_alloc+0x695/0x770 [ 2439.104449] ? trace_hardirqs_on_caller+0x3f6/0x590 [ 2439.109466] ? get_reqs_available+0x225/0x3d0 [ 2439.113965] do_io_submit+0x2c4/0x13f0 [ 2439.117864] ? free_ioctx_users+0x3d0/0x3d0 [ 2439.122190] ? vfs_write+0xff/0x4e0 [ 2439.125841] ? SyS_read+0x210/0x210 [ 2439.129468] ? SyS_clock_settime+0x1a0/0x1a0 [ 2439.133888] ? SyS_io_destroy+0x300/0x300 [ 2439.138050] ? do_syscall_64+0x1d5/0x640 [ 2439.142118] do_syscall_64+0x1d5/0x640 [ 2439.146017] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2439.151204] RIP: 0033:0x45c829 [ 2439.154390] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2439.162096] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2439.169452] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2439.176719] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2439.183990] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2439.191256] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:35 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) write$6lowpan_enable(r0, &(0x7f0000000180)='0', 0x1) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SG_SET_TIMEOUT(r2, 0x2201, &(0x7f00000000c0)=0x3b) 21:55:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x4000, 0x0) accept$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, &(0x7f0000000140)=0x1c) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:35 executing program 5 (fault-call:3 fault-nth:2): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2439.472971] FAULT_INJECTION: forcing a failure. [ 2439.472971] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2439.484933] CPU: 0 PID: 14578 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2439.492820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2439.502172] Call Trace: [ 2439.504776] dump_stack+0x13e/0x194 [ 2439.508416] should_fail.cold+0x10a/0x14b [ 2439.512574] __alloc_pages_nodemask+0x1bf/0x700 [ 2439.517248] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2439.522270] ? ____cache_alloc_node+0x153/0x1c0 [ 2439.526943] ? lock_acquire+0x170/0x3f0 [ 2439.530927] cache_grow_begin+0x7b/0x410 [ 2439.534991] ? do_raw_spin_unlock+0x164/0x250 [ 2439.539493] ____cache_alloc_node+0x16d/0x1c0 [ 2439.543986] ? check_preemption_disabled+0x35/0x240 [ 2439.549093] kmem_cache_alloc+0x1ea/0x770 [ 2439.553244] ? trace_hardirqs_on_caller+0x3f6/0x590 [ 2439.558262] ? get_reqs_available+0x225/0x3d0 [ 2439.562760] do_io_submit+0x2c4/0x13f0 [ 2439.566674] ? free_ioctx_users+0x3d0/0x3d0 [ 2439.571001] ? vfs_write+0xff/0x4e0 [ 2439.574648] ? SyS_read+0x210/0x210 [ 2439.578281] ? SyS_clock_settime+0x1a0/0x1a0 [ 2439.582691] ? SyS_io_destroy+0x300/0x300 [ 2439.586839] ? do_syscall_64+0x1d5/0x640 [ 2439.590902] do_syscall_64+0x1d5/0x640 [ 2439.594800] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2439.600023] RIP: 0033:0x45c829 [ 2439.603207] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2439.610913] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2439.618184] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2439.625448] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2439.632721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2439.639988] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:36 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000000000000900000000000000030000000600000007000000000000000100008000000000000000000000000002000000000000000000000000000000000000000000000002080000000000000000000000000000ca040000000000000900000000000000b703000000000000000000000000000000000000000000000001000000000000000000000000000007000000000000000000000001000000040000000000000000000000000000000000000000000000020c0000000000000000000000000000ffffffff000000000600000000000000ff07000000000000000000000000000000000000000000000021000000000000000000000000000041000100000000000700000000000000050000000000000000000000000000000000000000000000020600000000000000000000000000007100000000000000010000000000000007000000000000000000000000000000002f00000000000000000000000000000000000000000000030000000000000007000000000000000008000000000000000000000000000000000000000000008000"/424]) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:36 executing program 5 (fault-call:3 fault-nth:3): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2439.955147] FAULT_INJECTION: forcing a failure. [ 2439.955147] name failslab, interval 1, probability 0, space 0, times 0 [ 2439.977397] CPU: 0 PID: 14592 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2439.985390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2439.994740] Call Trace: [ 2439.997330] dump_stack+0x13e/0x194 [ 2440.000965] should_fail.cold+0x10a/0x14b [ 2440.005123] should_failslab+0xd6/0x130 [ 2440.009108] kmem_cache_alloc_node+0x288/0x7a0 [ 2440.013694] ? perf_trace_lock+0x109/0x4b0 [ 2440.017938] __alloc_skb+0x9a/0x4c0 [ 2440.021567] ? skb_trim+0x160/0x160 [ 2440.025192] ? perf_trace_lock+0x109/0x4b0 [ 2440.029427] alloc_skb_with_frags+0x85/0x4f0 [ 2440.033938] sock_alloc_send_pskb+0x586/0x6d0 [ 2440.038451] ? sock_wmalloc+0xf0/0xf0 [ 2440.042254] ? iov_iter_advance+0x1c0/0xc70 [ 2440.046573] ? _copy_from_iter_full+0x1b9/0x6a0 [ 2440.051248] tun_get_user+0x5d4/0x3880 [ 2440.055154] ? tun_net_xmit+0xf10/0xf10 [ 2440.059156] ? find_held_lock+0x2d/0x110 [ 2440.063236] ? __tun_get+0x11c/0x220 [ 2440.066955] ? lock_downgrade+0x6e0/0x6e0 [ 2440.071111] tun_chr_write_iter+0xcf/0x179 [ 2440.075353] aio_write+0x2c7/0x4f0 [ 2440.078923] ? aio_complete+0xc90/0xc90 [ 2440.082900] ? save_trace+0x290/0x290 [ 2440.086699] ? SOFTIRQ_verbose+0x10/0x10 [ 2440.090763] ? find_held_lock+0x2d/0x110 [ 2440.094830] ? lock_acquire+0x170/0x3f0 [ 2440.098806] ? lock_downgrade+0x6e0/0x6e0 [ 2440.102964] do_io_submit+0x996/0x13f0 [ 2440.106865] ? free_ioctx_users+0x3d0/0x3d0 [ 2440.111278] ? vfs_write+0xff/0x4e0 [ 2440.114910] ? SyS_read+0x210/0x210 [ 2440.118557] ? SyS_clock_settime+0x1a0/0x1a0 [ 2440.122962] ? SyS_io_destroy+0x300/0x300 [ 2440.127119] ? do_syscall_64+0x1d5/0x640 [ 2440.131183] do_syscall_64+0x1d5/0x640 [ 2440.135079] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2440.140267] RIP: 0033:0x45c829 [ 2440.143449] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2440.151172] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2440.158437] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2440.165702] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2440.172963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2440.180228] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:36 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) writev(r2, &(0x7f0000000200)=[{&(0x7f00000001c0)}, {&(0x7f0000000280)="b46669f0c7c0a8eb5c3ebf9a0f9e010d12688516f47f27b8f5aac79f036819e7a132a51e137e0e87cee9bc5ccdcc28ad8ba93609563f9cab833349678cfcdda8d09399301e8edd6c9e8d221dcfeced32fbf1fdc7af11b8258c04a66b7988386e2d09b67960405352593bba3f203cf8bf640c2425c8742f7dfeb5635514f9cd1d0c9bb2ce0442bf7a53cedb6351e252e8dfa29515bcb401abae6d9f63397e048317d34890254ee78218059f38ff1a440dc1cad3d2874d53764145474e74a76a953fff7d5a11fda9ce39fa4b0f0c748c1db5d0fe89f5fdb6bd021917310b63c6516078ece7d4", 0xe5}], 0x2) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f00000001c0)={0x28, 0x2, 0x0, {0x1, 0x3f, 0x2}}, 0x28) accept4$unix(r1, &(0x7f00000000c0), &(0x7f0000000140)=0x6e, 0x800) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r4 = semget$private(0x0, 0x4, 0x0) semctl$GETVAL(r4, 0x0, 0xc, 0x0) semctl$GETPID(r4, 0x4, 0xb, &(0x7f0000001600)=""/110) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ftruncate(r5, 0xc5) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000001680)={0x5, 0x0, [{0xd000, 0x1000, &(0x7f0000000380)=""/4096}, {0xd000, 0xfffffd7b, &(0x7f00000013c0)=""/67}, {0x3000, 0x7, &(0x7f0000001440)=""/7}, {0x2001, 0x9, &(0x7f0000001480)=""/9}, {0x4000, 0x54, &(0x7f00000014c0)=""/84}]}) [ 2440.309810] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2440.318632] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2440.324620] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2440.333587] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2440.342542] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 [ 2440.355801] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2440.364597] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2440.370743] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2440.379696] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2440.388646] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:36 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r0, 0xc2604111, &(0x7f0000000340)) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:36 executing program 5 (fault-call:3 fault-nth:4): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:36 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffb, 0xbe, 0x6, @buffer={0x0, 0x3b, &(0x7f00000000c0)=""/59}, &(0x7f0000000100)="1068a4102a372d17f65779addd3049d194a999a8d07d4610325aa353eb9b432c6b0c3608f94680b0f4ece5753f81948e8ec0d4ac41eff8fc37a32973c330f213e287f8c8863a0fa3f4bec5eb5386ad8abd815574f5514529aac960c53799c24fe5345610ae2776afd170f34c4648dc011a9bc50a992454dd0dc65e1123d2363cffa73ac0e6698ea8cb59fb28bb473aa23391fdfd81100f5af437c485112eedf71926d14689e4af10550dbecda090c5e1705029e316429fe545a39142bd1c", &(0x7f00000001c0)=""/42, 0xcd22, 0x0, 0x1, &(0x7f0000000200)}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2440.510648] FAULT_INJECTION: forcing a failure. [ 2440.510648] name failslab, interval 1, probability 0, space 0, times 0 [ 2440.555065] CPU: 1 PID: 14604 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2440.563014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2440.572452] Call Trace: [ 2440.575048] dump_stack+0x13e/0x194 [ 2440.578685] should_fail.cold+0x10a/0x14b [ 2440.582863] should_failslab+0xd6/0x130 [ 2440.586843] kmem_cache_alloc_node_trace+0x292/0x7b0 [ 2440.591956] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 2440.597407] ? __alloc_skb+0x9a/0x4c0 [ 2440.601213] __kmalloc_node_track_caller+0x38/0x70 [ 2440.606149] __kmalloc_reserve.isra.0+0x35/0xd0 [ 2440.610835] __alloc_skb+0xca/0x4c0 [ 2440.614479] ? skb_trim+0x160/0x160 [ 2440.618123] ? perf_trace_lock+0x109/0x4b0 [ 2440.622363] alloc_skb_with_frags+0x85/0x4f0 [ 2440.626784] sock_alloc_send_pskb+0x586/0x6d0 [ 2440.631303] ? sock_wmalloc+0xf0/0xf0 [ 2440.635106] ? iov_iter_advance+0x1c0/0xc70 [ 2440.639430] ? _copy_from_iter_full+0x1b9/0x6a0 [ 2440.644151] tun_get_user+0x5d4/0x3880 [ 2440.648179] ? tun_net_xmit+0xf10/0xf10 [ 2440.652199] ? find_held_lock+0x2d/0x110 [ 2440.656265] ? __tun_get+0x11c/0x220 [ 2440.659986] ? lock_downgrade+0x6e0/0x6e0 [ 2440.664162] tun_chr_write_iter+0xcf/0x179 [ 2440.668404] aio_write+0x2c7/0x4f0 [ 2440.671957] ? aio_complete+0xc90/0xc90 [ 2440.675935] ? save_trace+0x290/0x290 [ 2440.679740] ? SOFTIRQ_verbose+0x10/0x10 [ 2440.683806] ? find_held_lock+0x2d/0x110 [ 2440.687964] ? lock_acquire+0x170/0x3f0 [ 2440.691971] ? lock_downgrade+0x6e0/0x6e0 [ 2440.696131] do_io_submit+0x996/0x13f0 [ 2440.700036] ? free_ioctx_users+0x3d0/0x3d0 [ 2440.704365] ? vfs_write+0xff/0x4e0 [ 2440.708001] ? SyS_read+0x210/0x210 [ 2440.711634] ? SyS_clock_settime+0x1a0/0x1a0 [ 2440.716042] ? SyS_io_destroy+0x300/0x300 [ 2440.720194] ? do_syscall_64+0x1d5/0x640 [ 2440.724256] do_syscall_64+0x1d5/0x640 [ 2440.728154] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2440.733457] RIP: 0033:0x45c829 [ 2440.736641] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2440.744349] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2440.751617] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2440.758884] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2440.766161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2440.773428] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:37 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:37 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) recvmsg$can_bcm(r0, &(0x7f0000000440)={&(0x7f00000000c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/229, 0xe5}, {&(0x7f0000000240)=""/228, 0xe4}, {&(0x7f0000000340)=""/125, 0x7d}], 0x3, &(0x7f0000000400)=""/37, 0x25}, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:37 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0x0, 0x410000) close(r1) 21:55:37 executing program 5 (fault-call:3 fault-nth:5): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2441.054367] FAULT_INJECTION: forcing a failure. [ 2441.054367] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2441.066213] CPU: 1 PID: 14625 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2441.074095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2441.083487] Call Trace: [ 2441.086085] dump_stack+0x13e/0x194 [ 2441.089721] should_fail.cold+0x10a/0x14b [ 2441.093872] __alloc_pages_nodemask+0x1bf/0x700 [ 2441.098557] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2441.103573] ? find_held_lock+0x2d/0x110 [ 2441.107648] cache_grow_begin+0x7b/0x410 [ 2441.111714] kmem_cache_alloc_node_trace+0x6ca/0x7b0 [ 2441.116825] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 2441.122280] ? __alloc_skb+0x9a/0x4c0 [ 2441.126088] __kmalloc_node_track_caller+0x38/0x70 [ 2441.131038] __kmalloc_reserve.isra.0+0x35/0xd0 [ 2441.135712] __alloc_skb+0xca/0x4c0 [ 2441.139341] ? skb_trim+0x160/0x160 [ 2441.142970] ? perf_trace_lock+0x109/0x4b0 [ 2441.147207] alloc_skb_with_frags+0x85/0x4f0 [ 2441.151626] sock_alloc_send_pskb+0x586/0x6d0 [ 2441.156132] ? sock_wmalloc+0xf0/0xf0 [ 2441.159935] ? iov_iter_advance+0x1c0/0xc70 [ 2441.164254] ? _copy_from_iter_full+0x1b9/0x6a0 [ 2441.168928] tun_get_user+0x5d4/0x3880 [ 2441.172831] ? tun_net_xmit+0xf10/0xf10 [ 2441.176811] ? find_held_lock+0x2d/0x110 [ 2441.180886] ? __tun_get+0x11c/0x220 [ 2441.184607] ? lock_downgrade+0x6e0/0x6e0 [ 2441.188768] tun_chr_write_iter+0xcf/0x179 [ 2441.193011] aio_write+0x2c7/0x4f0 [ 2441.196557] ? aio_complete+0xc90/0xc90 [ 2441.200539] ? save_trace+0x290/0x290 [ 2441.204338] ? SOFTIRQ_verbose+0x10/0x10 [ 2441.208405] ? find_held_lock+0x2d/0x110 [ 2441.212474] ? lock_acquire+0x170/0x3f0 [ 2441.216447] ? lock_downgrade+0x6e0/0x6e0 [ 2441.220607] do_io_submit+0x996/0x13f0 [ 2441.224596] ? free_ioctx_users+0x3d0/0x3d0 [ 2441.228922] ? vfs_write+0xff/0x4e0 [ 2441.232557] ? SyS_read+0x210/0x210 [ 2441.236183] ? SyS_clock_settime+0x1a0/0x1a0 [ 2441.240596] ? SyS_io_destroy+0x300/0x300 [ 2441.244836] ? do_syscall_64+0x1d5/0x640 [ 2441.248908] do_syscall_64+0x1d5/0x640 [ 2441.252803] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2441.257990] RIP: 0033:0x45c829 [ 2441.261175] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2441.268882] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2441.276148] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2441.283432] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2441.290699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2441.298005] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:37 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000002c0)={0x0, 0xfffffffffffffffe, 0xb1, 0x8, @buffer={0x0, 0x35, &(0x7f00000000c0)=""/53}, &(0x7f0000000100)="09c5ac15fbd744a754ae29b9d37cfdaa63b2d00e7640c89d20f73a56b6264a36f723d520b7fa03a5596cb98cb2a66c5c9f3d719ef98f87b15c03715a02a7bf6974853f9f1ab0b59e84dd8e57eac59d74976791d1fc8e5f46b87e74e3fd13b0bb5c94ef3103bd37b9798944b765cfbce66e48f6455c3f373dc3f753c7549f3770047876872cf6062e0b13c37f933698e30c5f8561b2da34d6f66fe54b9a751cd078643ffff65edd26cab47e258bdac69d0b", &(0x7f00000001c0)=""/143, 0x8, 0x10000, 0x3, &(0x7f0000000280)}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:37 executing program 5 (fault-call:3 fault-nth:6): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2441.507695] FAULT_INJECTION: forcing a failure. [ 2441.507695] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2441.519632] CPU: 1 PID: 14636 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2441.527516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2441.536865] Call Trace: [ 2441.539456] dump_stack+0x13e/0x194 [ 2441.543089] should_fail.cold+0x10a/0x14b [ 2441.547241] __alloc_pages_nodemask+0x1bf/0x700 [ 2441.551924] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2441.556990] ? ____cache_alloc_node+0x153/0x1c0 [ 2441.561657] ? lock_acquire+0x170/0x3f0 [ 2441.565637] cache_grow_begin+0x7b/0x410 [ 2441.569702] ? do_raw_spin_unlock+0x164/0x250 [ 2441.574204] ____cache_alloc_node+0x16d/0x1c0 [ 2441.578706] ? check_preemption_disabled+0x35/0x240 [ 2441.583723] kmem_cache_alloc_node_trace+0xf2/0x7b0 [ 2441.588755] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 2441.594207] ? __alloc_skb+0x9a/0x4c0 [ 2441.598026] __kmalloc_node_track_caller+0x38/0x70 [ 2441.602961] __kmalloc_reserve.isra.0+0x35/0xd0 [ 2441.607638] __alloc_skb+0xca/0x4c0 [ 2441.611268] ? skb_trim+0x160/0x160 [ 2441.614893] ? perf_trace_lock+0x109/0x4b0 [ 2441.619144] alloc_skb_with_frags+0x85/0x4f0 [ 2441.623562] sock_alloc_send_pskb+0x586/0x6d0 [ 2441.628071] ? sock_wmalloc+0xf0/0xf0 [ 2441.631877] ? iov_iter_advance+0x1c0/0xc70 [ 2441.636199] ? _copy_from_iter_full+0x1b9/0x6a0 [ 2441.640873] tun_get_user+0x5d4/0x3880 [ 2441.644774] ? tun_net_xmit+0xf10/0xf10 [ 2441.648751] ? find_held_lock+0x2d/0x110 [ 2441.652822] ? __tun_get+0x11c/0x220 [ 2441.656544] ? lock_downgrade+0x6e0/0x6e0 [ 2441.660700] tun_chr_write_iter+0xcf/0x179 [ 2441.664937] aio_write+0x2c7/0x4f0 [ 2441.668485] ? aio_complete+0xc90/0xc90 [ 2441.672462] ? save_trace+0x290/0x290 [ 2441.676265] ? SOFTIRQ_verbose+0x10/0x10 [ 2441.680334] ? find_held_lock+0x2d/0x110 [ 2441.684401] ? lock_acquire+0x170/0x3f0 [ 2441.688380] ? lock_downgrade+0x6e0/0x6e0 [ 2441.692539] do_io_submit+0x996/0x13f0 [ 2441.696441] ? free_ioctx_users+0x3d0/0x3d0 [ 2441.700765] ? vfs_write+0xff/0x4e0 [ 2441.704394] ? SyS_read+0x210/0x210 [ 2441.708018] ? SyS_clock_settime+0x1a0/0x1a0 [ 2441.712430] ? SyS_io_destroy+0x300/0x300 [ 2441.716583] ? do_syscall_64+0x1d5/0x640 [ 2441.720644] do_syscall_64+0x1d5/0x640 [ 2441.724573] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2441.729769] RIP: 0033:0x45c829 [ 2441.732954] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2441.740667] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2441.747933] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2441.755203] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2441.762475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2441.769738] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:38 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:38 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000c00)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0693a3b0a10000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r8, @ANYBLOB="000000006565ffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000b00)=[{{&(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000100)="849daa792c700a31527fb3cae02cce90bccb8d32a8ca0d82b067f75f46d3e9c50ce45f3fa66e9ed7ec7a127c06dec2fc0e9f100219376af5ce2df00de85e96eef6da12aef2296d023638969bfecd3c4b6baef921d4b70d938229b2a7a6db89372606bf717995b394565a1f7ee8f8f170d0657ca124eca215dedda8f6a6afed43f18192ddfed4124208bc764722f90842", 0x90}, {&(0x7f00000001c0)="a62c631fa472d77d85fcc1877b40de26308c6f16211fb538b1d2ad93f6bc57f2dc9b38b1a5d52fadbc67984f2f7fa35d41c068d46c5f93feab9d4c8f8bc5b4df4c2a88b70dcf1a94518d4d474f9df27b092fb1c36f1f20b2f338366eb0ba109b68754f332aecf5b1", 0x68}, {&(0x7f0000000240)="1e445e18847b8cd0764ffc025c2597e3e17a98d62cc5008d80974c75e4c498627f0af0210b778e6f001ed5074d42f32a13644240be6564bb6ac78ef36de081972613530a37b37965e5b5a4a44a24dda25b0c9521a2c2e0ebdeb28ea66c9213830eb3227c3dd41b6e2d2f0d705f4f4658e44fe43c0297b521ea61be0f2d9c7b925ba440dedbbc6ac20d9a4f3493cf41dca7111911388ce0a32e7efc956f1cb37e9846b4c73bf72dddbf2216ccd9244466360cbae0f9d6e62bf4f3b077a0fd4e4645fb878d54813be2f0301ab82dc06c22f5e31eb1a71a7979e25eb017f8ce6784bbd782", 0xe3}, {&(0x7f0000000340)="83684bae61966e3489fd51c0c5251e72105ebdd6329eb3e88c1b42ce361c", 0x1e}, {&(0x7f0000000380)="4c46a3103790264ca85b82845e0ee259b29a2bcd228d36ec35efdc9e2875ccdbab665220b7055ec2b888bd55a9d37ec526cb0446ddb4bf8f6f034757af62a6a6c352d236450effe810430a50ac6f7b03d890ffdb7e7aa2cc8132dfaa409ace32eb1d303241714dbfe214ca7eb0aee59f28f1dd9604d0a5232f1df033447ba80554f8d6dcd18b347a3e8f6a4350e1f5f3d4b7dbc73f427c2ed8cb9deb", 0x9c}], 0x5, &(0x7f00000004c0)=[@ip_ttl={{0x14, 0x0, 0x2, 0x50000}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @loopback}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @dev={0xac, 0x14, 0x14, 0x1c}, @local}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @multicast2, @remote}}}, @ip_retopts={{0x40, 0x0, 0x7, {[@ssrr={0x89, 0x7, 0xba, [@remote]}, @timestamp={0x44, 0xc, 0x2e, 0x0, 0x0, [0xffffffff, 0xbe]}, @timestamp_prespec={0x44, 0x1c, 0xba, 0x3, 0xc, [{@multicast2, 0x20000000}, {@broadcast, 0x7}, {@empty, 0x3}]}]}}}], 0xb8}}, {{&(0x7f0000000580)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10, &(0x7f0000000640)=[{&(0x7f00000005c0)="eaba2a1345783d1456a6768000c96cd1ccec4188e7c895605543062df1925aa2e1be0ecf3b296aa0607155ac841ca0caac629048c10434fcf5c90b8a4aa483a3d1acfca1f2429b1c36306a7b3b9bbcc4db3cdcb0ba6056b35842a5b3439e27bc7d769ac242607f18d35b5cb854f26a8e429e", 0x72}], 0x1}}, {{&(0x7f0000000680)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000780)=[{&(0x7f00000006c0)="f3bc2883d4e3e82956e94dd3a1dd400a2809936635ab16de1e6cc442c271af5c532122c738e33a2fcae970391c32a0b2ffb77eca41a7af6901c88079b2ca6aba15a3f25c06c14cd3863b7b8edfebdef978cc57827007a76dec3407a7f092d7a52357393081dcd981d92f76afe12dbc7c17df28ebf9898568625c8a780bb017a01b5df987184c01922e30e4", 0x8b}], 0x1, &(0x7f00000007c0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xb1}}], 0x18}}, {{&(0x7f0000000800)={0x2, 0x4e22, @multicast2}, 0x10, &(0x7f0000000ac0)=[{&(0x7f0000000840)="571b45d22a2a557b68a1c66b6482b21cfd99e0f752bdb0540e5ecfb70500bb47cef337b3369738db7caca121399a59ee922015df345310dc85b901fc532f20c33700f7d0c4dd55a331cf4a9d41c22cf2a3f08d9d3ece8bfbad0712bc521dc5fde3f6c5fb6eda13f7d07081a824705c8020a1eec0ec79415adb8de3d25e30643ccaed52ca", 0x84}, {&(0x7f0000000900)="d6ee54922fac", 0x6}, {&(0x7f0000000940)="5e9147d1da0232f06ec05654fafcac6e6a55201a3a27ff8b4cace953993b0e730933fb331487f52dbc9c3a6d46fdc5064b53342a6a08bf2ba95d1ca387a2d154559b31ee7f7299247606dc24e65fc22617463e4b4e4ad7c5c93379f61f08fd758cb6aea57b770773074378c4dd7a9601e22a8442ad5419cf527409642ebfd86cc1eae69774ed5b106b171e5ce29a516328131f871e8fa2dc146e4344f12dd2546840ddf2de49dc", 0xa7}, {&(0x7f0000000a00)="024797b99a225b64ec0121bd3bd972e50e44038121b21edae2b5de93197e0ed230bcf2ee4749936e9cf02d878f8f30aafddcc7dc67698086c772f810cd5693eda7b113a0abf83ce57d2b9c9c34a2b08fe6257712730364876ac865402267560727ee8b64717c11ecd4e5547d354a4fd9ab757c49c03cbb600c2da3585bde5fd79fa67b1c10f25c3289e581e729d36dc6", 0x90}], 0x4}}], 0x4, 0x0) 21:55:38 executing program 5 (fault-call:3 fault-nth:7): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2442.081201] FAULT_INJECTION: forcing a failure. [ 2442.081201] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2442.115154] CPU: 0 PID: 14655 Comm: syz-executor.5 Not tainted 4.14.178-syzkaller #0 [ 2442.123069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2442.132424] Call Trace: [ 2442.135022] dump_stack+0x13e/0x194 [ 2442.138665] should_fail.cold+0x10a/0x14b [ 2442.142820] __alloc_pages_nodemask+0x1bf/0x700 [ 2442.147501] ? __alloc_pages_nodemask+0x5e0/0x700 [ 2442.152362] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2442.157378] ? __alloc_pages_slowpath+0x26c0/0x26c0 [ 2442.162403] ? cache_grow_begin+0x32d/0x410 [ 2442.166736] cache_grow_begin+0x7b/0x410 [ 2442.170802] fallback_alloc+0x205/0x2b0 [ 2442.174874] kmem_cache_alloc_node_trace+0xf2/0x7b0 [ 2442.179900] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 2442.185366] ? __alloc_skb+0x9a/0x4c0 [ 2442.189211] __kmalloc_node_track_caller+0x38/0x70 [ 2442.194166] __kmalloc_reserve.isra.0+0x35/0xd0 [ 2442.198833] __alloc_skb+0xca/0x4c0 [ 2442.202468] ? skb_trim+0x160/0x160 [ 2442.206226] ? perf_trace_lock+0x109/0x4b0 [ 2442.210473] alloc_skb_with_frags+0x85/0x4f0 [ 2442.214891] sock_alloc_send_pskb+0x586/0x6d0 [ 2442.219397] ? sock_wmalloc+0xf0/0xf0 [ 2442.223211] ? iov_iter_advance+0x1c0/0xc70 [ 2442.227533] ? _copy_from_iter_full+0x1b9/0x6a0 [ 2442.232218] tun_get_user+0x5d4/0x3880 [ 2442.236119] ? tun_net_xmit+0xf10/0xf10 [ 2442.240100] ? find_held_lock+0x2d/0x110 [ 2442.244162] ? __tun_get+0x11c/0x220 [ 2442.247924] ? lock_downgrade+0x6e0/0x6e0 [ 2442.252085] tun_chr_write_iter+0xcf/0x179 [ 2442.256322] aio_write+0x2c7/0x4f0 [ 2442.259866] ? aio_complete+0xc90/0xc90 [ 2442.263849] ? save_trace+0x290/0x290 [ 2442.267660] ? SOFTIRQ_verbose+0x10/0x10 [ 2442.271724] ? find_held_lock+0x2d/0x110 [ 2442.275791] ? lock_acquire+0x170/0x3f0 [ 2442.279888] ? lock_downgrade+0x6e0/0x6e0 [ 2442.284045] do_io_submit+0x996/0x13f0 [ 2442.287947] ? free_ioctx_users+0x3d0/0x3d0 [ 2442.292267] ? vfs_write+0xff/0x4e0 [ 2442.295916] ? SyS_read+0x210/0x210 [ 2442.299657] ? SyS_clock_settime+0x1a0/0x1a0 [ 2442.304069] ? SyS_io_destroy+0x300/0x300 [ 2442.308224] ? do_syscall_64+0x1d5/0x640 [ 2442.312284] do_syscall_64+0x1d5/0x640 [ 2442.316267] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2442.321458] RIP: 0033:0x45c829 [ 2442.324732] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2442.332579] RAX: ffffffffffffffda RBX: 00000000004e0a00 RCX: 000000000045c829 [ 2442.339844] RDX: 0000000020000600 RSI: 000000000000000a RDI: 00007fa3be5b1000 [ 2442.347117] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2442.354386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 2442.361655] R13: 00000000000001fb R14: 00000000004c4246 R15: 00007fa3be5d26d4 21:55:38 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f00000001c0)={0x7, 0x1, 0x4, 0x20000000, 0x20, {0x77359400}, {0x1, 0x8, 0x6, 0x6, 0x3f, 0x8, "b34e656b"}, 0x0, 0x2, @fd=r2, 0x49ea, 0x0, r3}) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2321202e2f66696c653020ceb4b95b588b1fa1c9296574683070726f63202f6465762f7367230020776c616e3028202f6465762f73672300202f6465762f73672300202f6b65756dcc0acd94dbe990769712979b52f3b58aa03e78461e55f66f0ed61210e81f519ad9f116d2eed274f9614a3b2675d708f5cfa1080578ce63ad0de0340e811fd43e943ea40b44e37365eeaddddc93ed006102dc8323365db83afe0a30ec4a02340fe04ca4d4d1d16881e3514328ec126c8f3e1951c5b17ead79b95cb18c3a5598d5ab035b572fa6bae35423175c1b5be5c404ba8fe347d7dd7c20e9593b1655611fc7a9c596bce22744e60dc441dfbe52fc31fbccc51bcee1694f1a36e39d3d00f28bdec3eec8756527debc78f01c0727fce58c67061035fd40403162b72033c72490dbe00e435ac76743ae66baf979fca084d61b7219473a8bec94f600fad321e84e"], 0xd5) r5 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) sendfile(r5, r4, &(0x7f0000000180)=0x7f, 0x9) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:38 executing program 5 (fault-call:3 fault-nth:8): io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2442.515138] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2442.523965] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2442.530022] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2442.538986] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2442.547937] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 [ 2442.608284] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2442.617020] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2442.623027] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2442.631997] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2442.640934] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:39 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x7f, 0x2, 0xff, 0x6, 0xb3, 0xad, 0x0, 0x6, 0x2, 0x1f}, 0xe) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040)}]) 21:55:39 executing program 5: r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r0) r2 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000900)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228897501f93191b076ac446ff0022b8753a1fa74ff569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23", 0x395, r1) socket(0x6, 0x8000a, 0x133f) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r2, r3}, &(0x7f0000000700)=""/243, 0x356, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x02\x00\x00\x00\x0f\x00@\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, &(0x7f0000000180)}) keyctl$invalidate(0x15, r2) io_setup(0xffffffff, &(0x7f0000000300)=0x0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000240)={0x0, {0x2, 0x4e22, @private=0xa010102}, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e24, @remote}, 0x24, 0x0, 0x0, 0x0, 0x3, &(0x7f00000001c0)='geneve1\x00', 0xe5, 0x1, 0x8}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r4, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r6, &(0x7f0000000040), 0xff66}]) 21:55:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:40 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x1c1801, 0x0) r3 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r3, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)={0x4c, r4, 0x400, 0x0, 0x0, {}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, @NL80211_ATTR_MAC={0xa, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}, 0x4c}}, 0x20040050) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) getpeername$packet(r5, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) sendmsg$NL80211_CMD_GET_WIPHY(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0x2}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x2f2, 0xffffffffffffffff}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xd7, 0x2}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xffff, 0x1}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4008046}, 0x20000) 21:55:40 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000040), 0x4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:40 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000000)={0x2, 0x1f}, 0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x25}}, 0xa0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={0xffffffffffffffff, 0xc0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x3, 0x3}, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x7, 0xe, 0x5279}, &(0x7f0000000600)=0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=0x5}}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13bd2321afb56fa54f26fb0b71d0e6adfefcf1d8f7faf75e0f226bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ceb9fbfbf9b0a4def23d410f6296b32a834388107200759cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee207d2f73902fbcfcf49822775985bf31b715f5888b24efa000000000000000000000000000000000000000000009500020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f7da31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a736770a71ad901ace383e41d277b10392a912ffaf6f658f3f9cd16286744f839c3f128f8f92ef992239eafce5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73755539280b064bd8144910fe050038ec0e8ca5457870eb30d211e23ccc8e06dddeb61799257ab55ff413c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d462357b22515567230ad1e1f4933545fe2c741374211663f6b63b1dd044dd0a2768e825972ea3b77641467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cc1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e87cdefb40e56e9cfad973347d0de7ba4754ff231a1b933d8f931ba3552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2af79b8d4c2bf0f7a2cb032dad13007b82e6044f643fc8cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942e367f603e3856a346cf7f9fe0bc9f2a1a7506d35e5eb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814459f3cdaaf9900000000000000000000000000101e009482f885d9df289b32f72b085f6ba58211c6080d4aaa4e49562159693026b9a0c0747d98ed9bcb3ce92e179a42934acb74761d2609ba440e5980f14e359d59043bfc813d0faf786f94f1e35c829678e6a6b2ae139a4986a4a96c21d93374a150a160c3a392fcc403410b00a7a0c3cbc3f2faace4cdc67a5580015a5500"/1282], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x16, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, r2}, 0x78) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r5, 0xc0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x7, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x52, 0xea, &(0x7f0000000440)=""/234, 0x0, 0xf, [], 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0xa, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x0, 0xb, 0x1}, 0x10, r4, r5}, 0x78) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0xb, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@func={0x85, 0x0, 0x1, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x6}, @alu={0x7, 0x0, 0x3, 0x1, 0x2, 0xffffffffffffffff, 0xffffffffffffffff}, @generic={0x40, 0x1, 0x6, 0x4, 0xff}, @jmp={0x5, 0x1, 0x5, 0xf, 0x9, 0x20, 0x8}, @map_val={0x18, 0x1, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f00000001c0)='GPL\x00', 0x1, 0x2d, &(0x7f0000000200)=""/45, 0x41100, 0x0, [], 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x5, 0xd, 0xfffffff8, 0xf}, 0x10, r4, r2}, 0x78) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) r7 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0}, 0xa0) io_submit(r0, 0x4, &(0x7f0000000a40)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0x0, r1}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7, 0x1980, 0xffffffffffffffff, &(0x7f00000003c0)="d153bc934ec30835492945e679e5e2c48127acc5179d386985203010ee886bca92b73f17e8e4cead7a3a09a70e826456af07d0112924e405ff1412907fcdd7042a00612c35fdd7dce7a19d2b5533d1d5caa488ae6113c1e186c60f38d7a8980ed09c10a67e2c9de8e257f0642b57b74a4f3a9b873170583e1e4fb392945ba4b95a43a776e23b", 0x86, 0x3, 0x0, 0x1, r6}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x4, r7, &(0x7f0000000800)="a7e2c91a190d4749da47937d25bc690eccd8f2402cbd25fbb08d51bc38dd1f20a696d55951e695b3857e9703ee7c73c41e91de9ba81ea73dd84b31e610abe46aa4d174dd30f5209a428782f80b7f0aa5db5b8d3414a5372f568b1b1d3b3af62ce372437d1e8ba61fbe6c8c7654e99239d311c37787821ff882723d9eda6df83e83428f4f5b8ed9556954bc35c18c8811d274f116c4e93281cc444bbb1fc2c8ba1120c0ab3394ea6aa50a9ddd36ce4c36af61275472fbe3dbc5843c9b64853da0563299a0d0e19cdbee6363ca70192f48227ae61bc31443ed162a2d085a5e573dba13bbd254b39db907439a8b95dce00b096225c5cbf066", 0xf7, 0x0, 0x0, 0x2}, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x7, 0x5, r8, &(0x7f0000000900)="df908c53d8276a791c46ae4b5d83fc0688263ded2aeb91e071f496fb20fb31352073de7dfa0211ff3dc5454127b2c8f34380ad2d69f5576c6dc0abfa22c89e2a6ac9c41b7f66b3e30f02e223b8573063ab9aee943f61f36e133fa8c307f4676101cbd21e451e232365d0b6c9a95d0df2e5fbed36de9273a2b16a21e794d40867eb7b02889326b8cd80fd6d1643f38f97b861ecb3b5e748c2dc436244d88afa0ce9c639673912083edadfbae715d4ad7ac25510de1ffcf512f80bb029d4ca5fcd12564bf5e7fd", 0xc6, 0x81, 0x0, 0x3}]) [ 2444.684731] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2444.693577] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2444.699637] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2444.708583] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2444.717516] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 [ 2444.823877] sd 0:0:1:0: [sg0] tag#2960 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2444.832720] sd 0:0:1:0: [sg0] tag#2960 CDB: Read Block Limits [ 2444.838741] sd 0:0:1:0: [sg0] tag#2960 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2444.847670] sd 0:0:1:0: [sg0] tag#2960 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2444.856554] sd 0:0:1:0: [sg0] tag#2960 CDB[20]: 9c 09 3f f0 09 21:55:41 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040)}]) 21:55:41 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) fadvise64(r3, 0x1, 0x80, 0x5) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={&(0x7f0000000040), 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=@deltclass={0x34, 0x29, 0x200, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0xfff5, 0x10}, {0x9, 0x1}, {0x7, 0x7}}, [@TCA_RATE={0x6, 0x5, {0x5, 0x1}}, @TCA_RATE={0x6, 0x5, {0x90, 0x1f}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000880) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000000)=0x8) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:41 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe2, 0x0) 21:55:41 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x400) dup2(r1, r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TIOCSRS485(r4, 0x542f, &(0x7f0000000040)={0x1c0, 0x61, 0x7}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040), 0xff66}]) [ 2445.699774] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2445.708642] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2445.714588] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2445.723656] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2445.732730] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 [ 2445.793606] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2445.802413] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2445.808550] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2445.817492] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2445.826372] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:42 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000001c0)={@private2, 0x4a}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e23, 0xfff, @ipv4={[], [], @private=0xa010102}, 0x200}], 0x2c) io_submit(r0, 0x1, &(0x7f0000000040)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x2}]) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000080)='veno\x00', 0x5) 21:55:42 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe2, 0x0) 21:55:42 executing program 5: io_setup(0x7fffffff, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RREADDIR(r2, &(0x7f0000000000)={0x2a, 0x29, 0x2, {0x1ff, [{{0x2, 0x3, 0x7}, 0x0, 0xbd, 0x7, './file0'}]}}, 0x2a) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:42 executing program 5: io_setup(0x7, &(0x7f0000000540)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb6000000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0xa0) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000000)={0x86, "310db422c195b8f25d4d6220b142d718045a1f0d92d364d620f41db79c5eb471", 0x4, 0x102, 0x4, 0x3e, 0x4, 0x2, 0x80000000, 0x5}) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000180)) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x1}]) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x28000, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r4, 0x10, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x1400c045) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xffff7b6f}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) getsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f00000004c0)=0x40, &(0x7f0000000500)=0x2) write$P9_RGETATTR(r5, &(0x7f0000000340)={0xa0, 0x19, 0x2, {0x0, {0x0, 0x0, 0x5}}}, 0xa0) setsockopt$inet_sctp6_SCTP_INITMSG(r5, 0x84, 0x2, &(0x7f0000000080)={0x101, 0x6, 0x6, 0xcc90}, 0x8) 21:55:43 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x84543, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm-control\x00', 0x50080, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r2, 0x541c, &(0x7f00000003c0)) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r4 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000640)={0x20, {{0x2, 0x4e21, @broadcast}}}, 0x88) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000240)={0x0, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) dup(r4) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18001500030085529495881c6327e2ffffff0000000000003f96bb126f127aa48946fb39e78ae0d7d1c301988beaf34a137e12be1783610058af34910d0b3b130d00a207971746e23fbd0a3ab3ba2e8b4a868a29360add260f763d58a222266fc71602a718001578b646029ab206651d5160102daa77d8ce9d1a9ec097591b879690065276638eeadde64eafcb2430cd5158f54b9805f853039caa8b407df1fc37c18f1bc1b399b1b4de424aa4b0f36ede570809d6e8c1df3c2a0ab075a9b73f8bfee27a06a148fd2566bc9ed7e8bec24b89e57e5f71f269e1c92801da4b0dfb2281ed6b52d2b837ddcdf35f09997c311a087157f4b617999daed491f0622e389d076247b2a6a65dba372880e037a30a85921226f74cda84bc5c165d139b0898"], 0x18}, 0x1, 0x0, 0x0, 0x20040004}, 0x4000000) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x440000, 0x0) ioctl$FBIOGET_CON2FBMAP(r5, 0x460f, &(0x7f00000002c0)={0xe, 0x2}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:43 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_tcp_int(r2, 0x6, 0x5, &(0x7f0000000000), 0x4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe2, 0x0) 21:55:43 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x80, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3e8f, 0x20c5c2) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000000040)) ioctl$NBD_SET_FLAGS(0xffffffffffffffff, 0xab0a, 0xe2) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r2, 0xc01064c7, &(0x7f0000000100)={0x6, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:44 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x10, r1, &(0x7f0000000040)}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDCTL_DSP_STEREO(r2, 0xc0045003, &(0x7f0000000000)) 21:55:44 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x200040, 0x0) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000080)) io_setup(0x1, &(0x7f0000000300)=0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x240, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xa0) setsockopt$RXRPC_SECURITY_KEYRING(r3, 0x110, 0x2, &(0x7f0000000000)='\xe8$user\x00', 0x7) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r1, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) 21:55:44 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2448.220891] selinux_nlmsg_perm: 229 callbacks suppressed [ 2448.220901] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.282477] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.322503] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.372497] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.416882] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.459908] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.492576] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.535421] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.566899] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 [ 2448.599555] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14900 comm=syz-executor.3 21:55:45 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:46 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:55:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:55:47 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000680)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)='\x00\x00\x00\x00\x00\x00', 0x0, 0x200, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x4f0, 0x0, 0x2f8, 0x1e8, 0x408, 0x408, 0x408, 0x4, &(0x7f0000000100), {[{{@arp={@multicast1, @dev={0xac, 0x14, 0x14, 0x27}, 0xffffffff, 0x0, 0x3, 0x4, {@mac=@multicast, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x40, 0xff, 0x0, 0xbdfd, 0x2, 0xff, 'veth0_to_hsr\x00', 'gretap0\x00', {}, {}, 0x0, 0x120}, 0xc0, 0x1e8}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xffffffc1, 'system_u:object_r:initctl_t:s0\x00'}}}, {{@arp={@rand_addr=0x64010102, @multicast1, 0xffffff00, 0xff000000, 0xd, 0x7, {@mac, {[0x0, 0xff, 0x0, 0x0, 0x0, 0x1f32bf47bc6a67e1]}}, {@empty, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x3e, 0x13, 0x3ff, 0x8, 0x9, 0x3, 'veth0_to_bridge\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x8}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x1, 0x1}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, 0x0, 0xffffffff, 0x0, 0xc, {@empty, {[0x0, 0xff, 0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0x0, 0xff]}}, 0x800, 0x1, 0x6, 0x6, 0x3f, 0x100, 'veth0_to_bridge\x00', 'tunl0\x00', {0xff}, {0xff}, 0x0, 0x1a}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="4e2ebbe0dc45", @mac=@local, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xf}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x540) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x60000, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r3, 0xc01064bd, &(0x7f00000007c0)={&(0x7f0000000880)="83cf56764dc408adacc900960a19bc3ff66b2650056ea61ea64b57ba60be0ec2a350ef6aade042ebd845dd60cc6b55ff9184ee335b842f55474bf460b7530b172e93", 0x42, 0x2}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) syz_mount_image$f2fs(&(0x7f00000009c0)='f2fs\x00', &(0x7f0000000980)='./bus\x00', 0x4800000000, 0x0, &(0x7f0000000e00), 0x1112004, &(0x7f0000000a00)={[], [{@appraise='appraise'}, {@appraise_type='appraise_type=imasig'}, {@fowner_eq={'fowner', 0x3d, r6}}]}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r3, 0xc01064bd, &(0x7f0000000840)={&(0x7f0000000700)="057b60fce6a2ba1d562531d55efcb6f5e423c560f71ce683001a60559ac8fc128ee1d86e5245de9323a3030a540270cb4a479d34bae118d2a6f93816aed565e99f0bd27f06f6bff111ae0beac0149897f251fe2f68d5b3d00e6239e33a9353b340c53297db5044ac2ca54501829878252c2e2983154e8994bbdfd4c1dd696b9235beb66178e081c85c383badca17869e1afc3bc6f0f3965511fe996b12aad4f08455b90000000000", 0xa8, r4}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r2, 0xc01064bd, &(0x7f0000000800)={&(0x7f0000000080)="c560fe8b998cbccd1f84e86f3b241bdc718b5af94cd0f2e6e39301", 0x1b, r7}) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x1}}, 0xa0) ioctl$PIO_UNIMAPCLR(r8, 0x4b68, &(0x7f0000000900)={0x2, 0x3, 0x2}) 21:55:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:55:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:47 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) getpgid(r1) 21:55:47 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x9, 0x80000) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffd, 0x10, 0x2, @scatter={0x1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/98, 0x62}]}, &(0x7f0000000200)="00ff7f000001df7deac63b002072c000", 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:47 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0xfd, @scatter={0x2, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)=""/159, 0x9f}, {&(0x7f00000009c0)=""/26, 0x1a}]}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000880)={0x0, 0xffffffffffffffff, 0x2e, 0x3, @scatter={0x9, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)=""/204, 0xcc}, {&(0x7f00000001c0)=""/127, 0x7f}, {&(0x7f0000000240)=""/46, 0x2e}, {&(0x7f0000000280)=""/122, 0x7a}, {&(0x7f0000000300)=""/235, 0xeb}, {&(0x7f0000000400)=""/187, 0xbb}, {&(0x7f00000004c0)=""/74, 0x4a}, {&(0x7f0000000540)=""/160, 0xa0}, {&(0x7f0000000600)=""/221, 0xdd}]}, &(0x7f00000007c0)="7ec03d2601115f6e5a228157edb4946d3edf563176d49ac7c325b45ee1233228cd08c1e8c39b39da21c05d2b6574", &(0x7f0000000800)=""/52, 0x0, 0x10001, 0x3, &(0x7f0000000840)}) [ 2451.593023] sd 0:0:1:0: [sg0] tag#2966 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2451.602077] sd 0:0:1:0: [sg0] tag#2966 CDB: Read Block Limits [ 2451.608153] sd 0:0:1:0: [sg0] tag#2966 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2451.617078] sd 0:0:1:0: [sg0] tag#2966 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2451.625961] sd 0:0:1:0: [sg0] tag#2966 CDB[20]: 9c 09 3f f0 09 [ 2451.705325] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2451.714298] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2451.720323] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2451.729304] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2451.738260] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:48 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f00000000c0)) 21:55:48 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$llc_int(r1, 0x10c, 0x9, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_PCM_IOCTL_START(r2, 0x4142, 0x0) 21:55:48 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:48 executing program 4: r0 = syz_open_dev$media(&(0x7f0000000180)='/dev/media#\x00', 0xfffffffffffffff9, 0x90400) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000100)=0x200, 0x4) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x10000, 0x1c8ff09d33770ce1) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = openat$mice(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/input/mice\x00', 0x391200) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}}, 0xa0) ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f0000000300)) getsockname$inet(r3, &(0x7f0000000200), &(0x7f0000000280)=0x10) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r2, 0xc01864b0, &(0x7f00000002c0)={0x8001, 0x7fff, 0x1, 0x4, 0x5}) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xa0) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SIOCRSGCAUSE(0xffffffffffffffff, 0x89e0, &(0x7f0000000340)) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) dup3(r5, r6, 0x0) mmap$usbfs(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000003, 0x11, r2, 0xe3) 21:55:48 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x2100, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc27}}, 0xa0) r5 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000001c0)={0x4, 0x1f, 0x1f, r5, 0x0, &(0x7f0000000180)={0x9909ca, 0x3, [], @value64=0x401}}) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000200)={{r6}, 0x1, 0x5}) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x48) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000002c0), &(0x7f0000000300)=0x8) ioctl$KVM_IRQ_LINE_STATUS(r6, 0xc008ae67, &(0x7f0000000380)={0x5, 0x3}) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000100)=0x8e, &(0x7f0000000140)=0x2) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:48 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x4000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = dup(r1) write$P9_RLERROR(r2, &(0x7f00000000c0)={0x12, 0x7, 0x1, {0x9, '/dev/sg#\x00'}}, 0x12) [ 2452.595041] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2452.604125] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2452.610120] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2452.619036] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2452.627947] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 [ 2452.695197] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2452.704177] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2452.710170] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2452.719086] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2452.728102] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:49 executing program 4: syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x48, 0x4001) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f0000000100)={0x1, 0x80000, 0x7, 0x40004, 0x0, [0x1, 0x5], [0x0, 0xacd, 0x55, 0xffff], [0x80000000, 0x80000001, 0xfffe, 0xffff8000], [0xf0, 0x8, 0x20008, 0xfffffffffffffffe]}) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2100) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) r2 = getpgid(r1) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x2a00, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhost-vsock\x00', 0x2, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, r2, 0x7, r3, &(0x7f0000000200)={r4, r5}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:49 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x8a, &(0x7f0000000180)=""/138}, &(0x7f00000000c0)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4200, 0x0, 0x0, 0x2) tkill(r1, 0x3c) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}, 0xa0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000100)={0x27, 0x37, 0x2, {0x1, 0x4, 0x3, r3, 0x9, '/dev/sg#\x00'}}, 0x27) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$setopts(0x4200, r1, 0x7fff, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x19269) ptrace$cont(0x3b7402c09b80d7b5, r1, 0x20, 0xc1) 21:55:49 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59788c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ppoll(&(0x7f00000000c0)=[{r0, 0x1000}, {r0, 0x4000}], 0x2, &(0x7f0000000100)={0x0, 0x3938700}, &(0x7f0000000140)={[0x3]}, 0x8) 21:55:49 executing program 4: r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f0000000280)={0xa0, 0x19, 0x0, {0x0, {}, 0x144, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x80000000}}, 0xa0) write$6lowpan_control(r1, &(0x7f0000000180)='disconnect aa:aa:aa:aa:aa:10 2', 0x1e) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r1, 0xc01864ba, &(0x7f0000000200)={0x6, 0x9, 0x1, 0xbbbbbbbb}) open_by_handle_at(r0, &(0x7f0000000100)={0x69, 0x0, "95d174b02d6e8dba0146e90e326f97edef220f52783b50447a6e7c360d6e3ca59e8eae3ed691b69c8493659345d31c895127c60d30c0fc93472edb91ee6fdb96596c75686a7675a908c55b899a94a8c404a8464c323745a6253c1084cb5e257553"}, 0x40000) r2 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x8, 0x139a41) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x10) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xa0) setsockopt$netrom_NETROM_T2(r3, 0x103, 0x2, &(0x7f0000000340)=0x6, 0x4) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f00000001c0)=0x6, 0x4) 21:55:49 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) fcntl$dupfd(r0, 0x406, r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f00000000c0)={0x1, 'vxcan1\x00', {}, 0x8001}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:49 executing program 4: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x480, 0x10) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000100)={0x7, 0x7f, 0x86b7, 0x8001, [], [], [], 0x460, 0x0, 0x6, 0x400, "eb6de370f818329edc870467f5293f23"}) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$MON_IOCQ_RING_SIZE(r0, 0x9205) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)={&(0x7f0000000300)='./bus\x00', 0x0, 0x8}, 0x10) write$binfmt_aout(r4, &(0x7f0000000380)={{0x107, 0x1f, 0xff, 0x3e6, 0x331, 0x5616, 0x3b6, 0x81}, "dad3de95d8f8b1d857139c41bc04d4d7a403726e8d331bcf86fd1c66aaebbb3be6539b3dfb7f188160aa1b"}, 0x4b) r5 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f00000004c0)={0x1, 0xa, 0x4, 0x200000, 0x10, {0x77359400}, {0x2, 0x0, 0x7, 0x7, 0x0, 0x1b, "205ae469"}, 0x81, 0x4, @offset, 0x9c2, 0x0, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000540)={r5, r6}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000100)={{{@in, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in6=@mcast1}}, &(0x7f0000000200)=0xe8) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) write$P9_RGETATTR(r1, &(0x7f0000000240)={0xa0, 0x19, 0x1, {0x415, {0x1, 0x0, 0x7}, 0x107, r7, r9, 0x6, 0x0, 0x10001, 0x6, 0x1, 0xffffffff00000000, 0xffffffff, 0x7fffffff, 0x800, 0xe70b, 0xed33, 0x0, 0x874, 0x3, 0x1}}, 0xa0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f00000019c0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001980)={&(0x7f0000001a00)=ANY=[@ANYBLOB="100000000f1401002abd7000fcdbdf25e78ecfffa8739aa8b033dc902548a199856fc9ed73b7bb6aeca08d6879a6587c4c6813fa810478aba64827e2634ff9aa2fdf110219ae3916367947729bcd71d531926d5c5ba577cf131553c174178db7f306a9201bede48e6245ba5eacbee4ff23e714e4d05f4dac3d720253800622fc03e7d73f2d046d1c89e5727ddfcce5b2a045ab51a8"], 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) ptrace$cont(0x20, r1, 0x0, 0x0) process_vm_readv(r1, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/204, 0xcc}, {&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/99, 0x63}, {&(0x7f0000001240)=""/163, 0xa3}, {&(0x7f00000013c0)=""/191, 0xbf}], 0x5, &(0x7f0000001880)=[{&(0x7f0000001480)=""/223, 0xdf}, {&(0x7f0000001580)=""/129, 0x81}, {&(0x7f0000001640)=""/236, 0xec}, {&(0x7f0000001740)=""/168, 0xa8}, {&(0x7f0000001800)=""/54, 0x36}, {&(0x7f0000001840)=""/64, 0x40}], 0x6, 0x0) 21:55:50 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:55:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x9, 0x6, 0x0, 0x5, 0x0, 0x5, 0x14, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xb734, 0x3f}, 0x0, 0x400, 0x0, 0x6, 0x6, 0x3, 0x4}, r1, 0x0, r2, 0x0) [ 2454.102293] selinux_nlmsg_perm: 467 callbacks suppressed [ 2454.102302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2}}, 0xa0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x8000000, 0x8, 0x38}) fsetxattr$trusted_overlay_origin(r0, &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2454.161711] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 [ 2454.200058] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x80000, r2}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2454.272935] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000000c0)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffd, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)='\x00\x00\x00\x00\x00\x00', 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2454.328858] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 [ 2454.400693] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 4: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) accept4$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2711}, 0x10, 0x80c00) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59049588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2454.500733] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) socketpair(0x7f, 0x5, 0x80000000, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000280)={@private1, 0x0}, &(0x7f00000002c0)=0x14) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_IPV6_RTHDR(r4, 0x29, 0x39, &(0x7f00000003c0)={0x8, 0x6, 0x0, 0x1f, 0x0, [@private1={0xfc, 0x1, [], 0x1}, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}, 0x38) sendmsg$nl_route(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@ipv6_getaddr={0x3c, 0x16, 0x20, 0x70bd29, 0x25dfdbfb, {0xa, 0x1, 0x8e, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @local}, @IFA_FLAGS={0x8, 0x8, 0x4ac}, @IFA_FLAGS={0x8, 0x8, 0x290}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x24004880) setsockopt$inet_dccp_buf(r2, 0x21, 0xd, &(0x7f00000013c0)="651b4f7765332374f389004cfa7b8923171e5f28da2a3eb35527153b719899c3b3c09cc47e2be1c25ad42b277e406761272049d11970f3e093961f888f221e3ef4acb18424ee2af1fb3398ec90786f1f9c905325da896441ba08b003fde45aa376762c49fc252fce577bd47fe38381546bffc75ee8fe790b4cc6729831e5a58cb3b0c11874bcefe856abcff47fa9732179e8c6388e1bb9b13682261d5171d765ceddbe660dfff2096035576a0ccff6109d090fe818a7debfb3f694b466567f5c4eaf78ad1f71f478a07be2d758467e261ca8cea0d2847e4e09f7623cbe8ece2b0aca1f2f393ac9880b1e429653cf3f768a9b3d5e7d58d953d1eab1bef623eb3bba1ec38f3f0291053de9737a2570dcc838897a43adc9a2730e6e65cc169601d0dc8c1a97032c5537f7ae774972dce0fe70e5ebc57093e7be8d337d70c754b7d06b68eb27bebf87cc9379fdf92820607ddfa5596719cc49bb190bd0b77f9d27fa3ca5b802aa4df8c4252498423730bacb4bdcdf0f642168f19c1b0aae2df3ca0a4f6abfaa58fd704c2787c9bc76216addb5374320d0a9909758ec8c6e9bb39fe9566aa18f2b28c7e8a70d2850874186bb0b90d91141cc69f9b1edbb25eada24fd5aedaee0815039151c65f2ecd1aeac4b3c39e4d31eac3d4e41633b82052cadde83502e88ef22e25b2a967ab79b94992e35a24defa0632e660cbd351221b441427bc74765846edc062548c2842ca80a117480e0e6ea86104ef5a10932a9ff908235c73046a8d93dccdc8107cc4dc70f80c11c55484d53699fa063825a740fcb32dacec6cc84efcaf755d3f4f01698601b691df79620ab21dc388f1ca1e8b290c5982f1dbe9a3d413d441a58ca3308c03e189cce922de8004deb3b600adad0f36d8ce7a05d3a46e4c3c6c74289ef9454f22a983bd81b4bde03e3470f58df95605e8a67bc670efb9b8ccbf1d91de70bd23c79a9907c19906981f058102535e1e5fc3237d9d536709bc075866d9fa96b2f8ffc214b97defa5b86db8efe23d2763a5ffbfe52588f0e9594f91058ba2c784e26c74a89bca4a8d418dd50b3cc2973f9670cf3085aee936d8f9c632842e117c4de4b8aaf5f0c632d8ffdbafc28dbab0458c0ec2eff57dffeb0cad87961792726ac2b046703cb262747c43fbdc55b1cf21a4be14c8f8316db74bee2f9d52ab38556ce182c44245e429be10791ea1302d31a392cad3699b2b15fc5ac094111c47ac94f1372ca883db04fabaae66e6134d89ccb3333d1bf8220f7fc6384d2e7bbce645377ad10f0210471f643370adda765bf5a15bff998a218717de04038793f123f04e3ced63458b6b4989ba858ba0e050fe231ac3ac911548fa6899a4856efad30d811463df79e6138dc7f359a9273767ef9bbcca4944f47830da54b75443d53f0963e1e220220a6ee80867ff36dcc62a49168d9b5e56b917b2606a13b0daf2e04f7e5044927588c1e7d5788121d05151eccfa6a31af467849f4efa6cdd687f64191a5c04dac952e4014055b7f8e2606aafd5a8d5626ad8251de3ef6595af44b27bc98d0ecf2b27de732f3f41b896bf6001d157db1b2016467e3a48cbe921e14479b191298bda900a701cedfb241a147b090805a1ba3c6098cd1b377343570b59ab9207c80242822c05a7ebdf8e1b3eea9321a4432ffba195a44ea344ea23dc2cedd52acdfa5ba7f5101998128ea0a05ab6e22a269137596fbcef065dc617a4d1dabb0c4d922c95e40ca069375184a5d3a18786f8084db6227ff1f09252fe666a1163594e7f073532acb1dfe2a0aa59bdd5853a52d1e9dac71df59a366fe4009db4e21e4f3454eed81d4372bd71df2ac613cd1bb3bbac31902a5eaf6317e4c9511401891492c0bcc54d8f313784411e7f23fe3fd4f5b422928516cc087f8dc4ccef5861731fffbc560a2910a20cc535c571bc5f3bf7f6042194a5b36d6324e4a428acd758915df906121e0cc676a9776d534c9196a78bb59ca7f7b3058da674e73b5f7842542ca0dcecc8e78d250278a007b05b0ff96009de0a35454e8ac6609bdc15f5e68904256fb62d6d548517657fcfa8a884592561944fd0adb93ed65d454bee1ec2aa7c3c541a6b55fc7113a171850de82835c42c15ba34ed87b30e7aeb1b1c58960a1884c586b3729e6cc94a6c0b7d52f2c8908e4d00b0c55776a1ce4a0c12629d986d452450c88b25d74034feb0dfb5bae049add930b6e7f82c6ca228472820fb2da1cfbf582db8488a5f4ca8fcd0cbc2698738fdaf9246858b597027e305e06ff6f0131a9aed05f2e545a81dd37cf3bfc9c9176ec6644cd17d0fa58543d200e1a170c7fbf70d36e53db476d163df5fe24cf8e298551c8aea3ef61d8087af416c5ffa6fc6dd0dbfabe7ee1124ccd424eaad2c51ceb0cc2e7d2c79c4f47994cf1a3b214e7d0d4986fde54a26727d33e11106af4a93a9fee94686665bef2150d2345ef93fd1b13ddbd1c35351664d419fd90f0b15096f41de99537c6d4d139cc5fa7ac7e031cda6147b92e1f90e1cbf6f7881bbbe39143a086cc248f62831363b5d4e6085ae56a8d3440826fc752c263903c4f1cd02036726514d8c221fb9cd2d47d7863dba8999ee497cc24043bfde103938e3c44fa148b00b46f0b96e1c462f3ac9aeb9e5af8f74f72fd51755ad1d68b249d1c73110352375e6e5d36cfff1cc2814b8a134b23921bea097c5b9525f85bc9dd300e24aa6705ec9f7059ad2fce3f2b309ce202786440f2b5d65318ec7744720828ce4ed99063f39bcbaf07d2e4744ea59826be7d16e3b42624f36a0c8c0b7003f42d322b0a6ea22c9fe4f2f548c826f0fa56cb1a6c56feffdd3af3bc2e779b01485d7d964335988484a8cb5c583e3f5bfe7f1c256df03abdc2c750d6e9ccf5a74a5fa6702e4af42037dc5241295f87cb71b6456719e9d7437c8b5d0e9ca9472a004d57f0462022a556c38634af8e38ff155e76d69539764ef0da71d91e5631c039be7ef77119157f7bd5b6008641a51cda95b0323e71cd4816cc4db6f38e7db57ebca9664d6fb98fe1f23681faaf12f9ef62809ab5afac61be4944ca5acac61c291d1ebaa215e2b52c00ce1734ab35e6d82690002fefabe16aff26baebf5d79ebf77dc27e1bdf689b8548376f377b47439d17d1f39beb74d1ca9e7d60ee111df1c858c024a2eb3ae7f78318a1ba6237d82b49d05995d4ae999b621e7f36c98b41980a894c910455fd8e6b4e8d3f47642feb62d589102b37996d0760eab03110577e98bdf0d40b8d60c09609dc88d7f098e1b333ee00d9e96875faf91523ac97c74ac5533fb814f3c026ea06a31e299da281b6035ae625658bbbb989f31407fe950ab5394bf2a713d23c1143e38c603afc35699e03e2b4734105da0adf80f5c60ff6bd851b80b955caa99e0b16cc775860f6427369b8ef2295734b49a1236ff2eca1098f2ffca886e83b9e5169fd74229f7d1b6bc9e3ae206ba67fdaf1ac839712bd33b1b01e35fb7774cc488ad9890c33d196fd47654ba47ff132559011814d0e74ad5cf56982c1484eca80398902c9bf367a81f1e34382f0a149e29e5e584548ba75e050b86fdba4247e5f0271f9c35971cf90dd4bbc61cb2f0d22c2c46fd9e114c90bebb849e7f299ea25b83faa8aa2b3667a2c2c167dcca7616eca939907437c1463eac82393e7b7954f759792ac4d340c7c18afa812d77f52bcfe1cde4e238a6b2a46a46e6da018718f1de709b7d696cd1c084fae734047498fe0b2e6d4d0f6ac7c82a324b7f11639fc90c7fdace1644d3f23a8f4e11e808a77c5bb3f275d367546d57be3348ecde6864294a36148d41e62d2c75187949f493046cd0987ce876c828d6b3b95ddc716884f1c0e41307db06798dce2b7583c503b7172b4d0e80e680bd4430e49c39369520091311033367e48b7f03f9eb5ec8b702cd5fac55b911214a3400e96430d92cd2d41bcb5d7a1ca78df5b66768ba6901d1e6ffbd5cac7343dacaca457e703666c6a3e0ba36708e6bca7c73d2bb281174b13c94d9c52fb839b1d17670e655fb013193ccb61328d5c6e09cf66bd2f59d614864f12d44447bd490d2d05a5a132cddffc4580fe29866fe43a71ec07daa7795c3f4ef751367f54bde013dd0f43e6511608b8a38fc6842a8a7d5c9c9d3dec1f4f103d5fc4f7b6c78ce738acc50808872d95ef48e1b91349c03cfad16ef04857d99a4a83486c0e0d5a6589eb23c3a5e33cbca70805bd2815607531ee8cabb7c1e60934e20e47fe02dbe84232bd60f64766f7f8db15d73a71d1c4b36593bd0eed1a7560842dc13cb5ae45507717da443df56da1088a42770cdbf841707a3cc2e89479a0d8df631b537a870546ddfb47ff2ae6976c2fa761c48ba2f85124492968f68deb8b1a281465ec262a98856a7d1140d416930cc2cd7d757e609a57bfaf424e716182142ba87dad26699b1ae1ada8d88670126c5603d88a94b98ec0c4ae6580945c1f7212f2924bac7459dea1b4dd318bd9d99a04ace970e9f681a9a6b5451bb991bff6fbdaf80552a0e08444d33b94d6b2e99d08f422e03c9f5b74446ac5854a642d6c6c143d90649b68718771c765b0a40269df391a15aa040d2b6b1d25c3ffa38bd8fc5994981399f9df92d5a462adf6d1c372852d2674ed33513deb7e0d123720285c4c81474da7f7f46193952faf28d1cd01dfaf887596e80bb7237484c27728c701bef98a4733e75e31534b27a077f2194d2372fc5779ccaf1a4b73709d9b68542e1f6d98cea13214c7b27b6987cf0bbe40a66d1ddc55c94e61f5ed3e16ceebfe9de4e220c57d06dd65427c6f902e2769b5e6215cf88ce026c171bab7487245ed339a318537490165d42b1acfceafff768af9af3a02e9900c6fb90fe10ad9762c959838068840f4e6f956c86e587502e2744848f1c4c95e1fde1ae7b1d3f9972de4b64d300d3234fcb7023ab1cadb6256f2dc0868025093331900ce06a4b80548e923f6fa2977034111bc333e7ca323526d16e411e4b03727cbb214c4a00dcbc98a3a12145f11b24b69b51903fc6b18d93ba60cbe422f16f83cb97d3f7a32614dcb0f2a051250caabb19a50313bca7ce5ff171f6ecc25c09305f339445c92763a174fff6b4e8a272da551b27b7968b14f9eaff1325c3444ef23a4cce0da1becccfaf644a26e536d93929feb5aef2f592e659ac0ea6235e743904dd6e61078fd8a751960a8524f5aeb7eb0ac914eb4a1fd4ef815d48d886d5a8f3d2198ab49ba279ae0e5c554ab6f0a8970f9d4079dd648fa031da6671298a4963ba539cfea892e9af1e56f6b6fe44fbd76f37e21f665ed31cd40e1e98bf309ab1c92df0dda4d75498517b4ec6c3f44e7f63259d07e5219e5c294d0f0ab10b9f656d7ecc02c9a1f2d652c46b2c5347bfaf746fb7789aac4cdad1a5ea3ba85f6a62f4a537819c784fd79367159aa909e69f41f3dd38c9c3076d514d4091f8c35c8e75e5fd4b7a3694f83af3308b6056368ba65e74b2e65e8cf3466744881db5509136ed4a299911d8c1fe74eea5428a682b8d46c19bbd8ee9c9a8eba49466f24b70724bdc217e66aed6f15081e59842896db65875e12824abdf815b8121eee7536f2314a3cb708d01cbc90e485bf9d350d0a96b957a7080acdf7feb21b2de9c0f066bf10a2e38c642ddc33d3237dfffdf702ab4567e7444f04bc4eddfc5b96a5c1683e4bf077d399777352882afaf1c734b5dc618f0d50c87ee8cf2a9e8c689efde7d73d3356aae7a22dd92d11e5921a10ceb53051d31f1e677666f10010e50296e2b91", 0x1000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x1ff}}, 0xa0) fsetxattr$security_evm(r5, &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000400)=ANY=[@ANYBLOB="0202800000000100a907e462066dd0ff31b130cb3927f47d404b8526705d13d3b964ef8c30acbfc729dc8e2a164c4bda9230c6289ccb7cfcd4bb0f46148b0682cf90603d2f5e6660873edc7500000012ed4917e4bde573b29702ed358fd4254c44b76a1df1ef853fc402e5675c5fc8b81eb6c1214ca50300e6e045def2dff19ed6f02257b40865c3b1bf55f6453a470f164ef3f348e71ff5718eca3e2982c2221c8c6be4b47c6de50b3be48c9d861d0767f3cddb9af37fab3e5e8c575547ddf4e4b1c609df1fc15daf3080a108033a593e33fddd1158d7f15e506f7e022e158c585facd350a12275b3fcb72dcb398de396e014c55500ff85eae7af9a3fdc6af911b03f210cf174850783f0de5720cddd13de"], 0xb2, 0x3) [ 2454.543962] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SIOCAX25NOUID(r2, 0x89e3, &(0x7f0000000200)) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x3, 0xc, 0x4, 0x2000000, 0x0, {0x0, 0xea60}, {0x1, 0x2, 0x9, 0xbe, 0x2, 0x6, "a35b8663"}, 0x6, 0x1, @fd=r3, 0x0, 0x0, 0xffffffffffffffff}) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0)='devlink\x00') ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000180)=r4) [ 2454.610786] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 21:55:50 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) syz_mount_image$ceph(&(0x7f0000000040)='ceph\x00', &(0x7f0000000080)='./bus\x00', 0x8, 0x6, &(0x7f0000000780)=[{&(0x7f0000000280)="93de5a53490b74c5609b2b986d60c3898a42574318b86916ecb93800790050116f9b7063672cfa1f4feae24696653770a043a8602c4fcd0963598f5e4750fbd9047e5dafce0f5d83038a7a9efe3754843e20879f5ca6f87b34b2fffff77a50d6030565e75e4929ec18ed78f712854bfbbed7919baf576d6759d52803891bd10e780bd490bf3f46c4c10638145913d7e13d76ab1dbe20260ffec6a71287a6facd184c16f39b764c90eaab291544a152ad9911d8b28aa9f2377c731a951dd385361ff8940f330cbd53d80c", 0xca, 0xfff}, {&(0x7f0000000380)="7c1b493ccffca3a15eaa6d0c5ecd5668575e11a843dde070c8fcb8d3219a22c428cf09fa0f0d72dce7b7c1191a37eefc43fa9a097aac3764e07c64525d4d83e245509a04803f29660b27", 0x4a, 0xffffffff}, {&(0x7f0000000400)="5cd0c9e1ae26ab4312858fd7a574e2767e40b61d38622351c373db63fed5884c3e7e0a81bcda3bebbf6500181009857009d7b439ac69aed738e24cabc6dea90b719c36551133776f7170d2c46a26431faf3282bd1609fbb2db38ecb9bb5bd683d3d83a2dda08dbef1994cc3ad89cd3464b59ba4853fe4e04177fcb823804fa7d0ec00d9a9d9fa024eb5d58166469c3265b2c3c35c4d6fbc33c016f3092deae9af817a71964d439acdb52deae831f6cca141df150f21dd305e6f4e802584c932d6282b6384b151244ccc6674470c3ebae077e6cee70851463cbc21301043d403a2586f0ace0bab4f7ca40376687a10b82a5bf0450407019", 0xf7, 0x3}, {&(0x7f0000000500)="5b4a1e88530b51c952f708645eba09b860dc8897e85c2befaef1971005a74b7aa62c9184f4466e819bbcdff1c9ab3ef5c67e9cb9ae863bf71eb5b652445b6b5a15f9366a72e0d219c97260c325a4eede9712225d556f558b33c881e10c4327d1533d3fff1c6504ad6e33237c7c951ae7aaa48d3731c98b2158d7c91e1329eaa6ab30c94ee434e65135a389559f532195aaf3f842730d9a9419", 0x99, 0xfff}, {&(0x7f00000005c0)="127419b52cd65c47bffad800cb42361b0152edd01cedf00bbb545eb33e435eb28ed52429644c31abe7236b941f176cba3d60485d4bd2bc0d11e5127d380b39383ef22a9603b527661065d4ebb38fe63271a1f90b42fe8e392dea38cb76baaec9d67ecc3a5a07166705cd0d2f9308e2971a1a2cf569fb375f55d6bac71168c9081f6577592427a881133133c9d01b83a03b9ef6d02e2642b4d616e0c5ee3890cff849f11267b75b711203d627a1bcf51a7a7593d8ebf9456c04e2451f02b8d6f4e3ec3f039500cf454d11b8b1b80a48d17df61c55c728ff32a7fee07a6aa234e92397b8eda4c70d183cca3624", 0xec, 0xffffffffffffffb0}, {&(0x7f00000006c0)="296d86d6006532caa11c8f2f98844012048a61ceb2cde341e3631f943230be28893780abb4945ca2c609f43c80c7d8f8dd09a0878e364f1189a90c481d7727b350492ab2a5a49819957b7a4afae6fdebf7a76a69fb77e7fc3195647b28ef6cff786368809566ca6229df4a19bb5ddf7cab698c0c98bcebe285c2e7c7cebf572d0dfc5ceecf667b26364519d052780a7b400325bc1a", 0x95, 0x7e40}], 0x1, &(0x7f0000000200)='\x00') read$eventfd(r0, &(0x7f00000000c0), 0x8) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000840)=0xfff, 0x4) ftruncate(r1, 0xff) r2 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0xffffffffffffffe8, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2454.674032] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15010 comm=syz-executor.3 [ 2454.770731] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2454.779628] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2454.785562] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2454.794674] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2454.803606] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:51 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) [ 2454.874948] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2454.884098] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2454.890086] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2454.898994] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2454.907922] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 21:55:51 executing program 4: r0 = semget$private(0x0, 0x4, 0x0) semctl$GETVAL(r0, 0x0, 0xc, 0x0) semtimedop(r0, &(0x7f00000000c0)=[{0x0, 0x6, 0x800}, {0x3, 0x3490, 0x1800}, {0x3, 0x1}], 0x3, &(0x7f0000000100)={0x0, 0x989680}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_tcp_int(r1, 0x6, 0x10, &(0x7f0000000140)=0x9, 0x4) r2 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x181000, 0x0) 21:55:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f00000000c0)={0x3}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_RESERVED(r1, 0x5601, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:51 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@rose, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) bind$netrom(r0, 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000001c0)={0x0, 0xff, 0x800, 0x80, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000200)={r2}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[{}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000180)={r3}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[{}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000000)={r4, 0x2}) 21:55:51 executing program 1: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0x6c, &(0x7f0000000780)=""/108}, &(0x7f0000001380)="59a595a8c65b", 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) getsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000180)=0x70, &(0x7f00000001c0)=0x4) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000680)={0x53, 0xfffffffffffffffe, 0xc9, 0x3, @scatter={0x3, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)=""/124, 0x7c}, {&(0x7f0000000300)=""/159, 0x9f}, {&(0x7f00000003c0)=""/76, 0x4c}]}, &(0x7f0000000440)="6fa58db5e2245864d922aed2968ec4c8dc2270cbfa49131b5ad48ae4d50463b16e8dc5e651032cd373a3022eb27c07533481bc55a203fe7b5570df4dbf2e185cc8d74d007ae019a21ce6b2b8c11857669772d328e2a9beb774cf7d1a666c857507ba1efc1d351cb10626dce66ba62b1513acc1a1fe6a1003273c06716dfafa39de8c9e11594d1503cda50ac54c3248665ee0fbdf034c0ab708cd79c0f7a1b7b4b8694ab8882e82c4d78f0113ceff9c719d690bd4c913315dff7be63ce3de3da21fd1596d7a767865bc", &(0x7f0000000540)=""/223, 0x7fff, 0x0, 0x3, &(0x7f0000000640)}) 21:55:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x1000100000001, 0xffffffffffffffff}}, 0xa0) sendmsg$AUDIT_USER_AVC(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, 0x453, 0x800, 0x70bd2b, 0x25dfdbfd, "5e98422ede145703627ff2561f185a34498022b6bfedb27eea8f91ac14c9b1b03fb630ff8094a8cc0698ce2fe7b15200b128543c1c23e8adffc14b6df277137f1725896045e9b32cc510943ded", ["", "", "", "", ""]}, 0x60}, 0x1, 0x0, 0x0, 0x24044091}, 0x20000000) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000200)={0x27, 0x37, 0x1, {0x2, 0x184000000, 0x7, r3, 0x9, '/dev/sg#\x00'}}, 0x27) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}}, 0xa0) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x401, 0xa, 0x5, 0x18, "bd52d3a59ce48228906515ddb75a190dadb43c206042a6a0de3c6a190b5caa6cf7807e3b91267a2e111f670b4e1bb76d863f63dcfd434e744fcf4dabac8b9ea1", "476d4ed146485259d5502aab2f9068972da00839d06671cbea6f77035cffa7ec", [0x701, 0x7]}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2455.296330] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2455.305126] sd 0:0:1:0: [sg0] tag#2996 CDB: Read Block Limits [ 2455.311172] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2455.320118] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2455.329343] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 9c 09 3f f0 09 [ 2455.363476] sd 0:0:1:0: [sg0] tag#2966 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2455.372582] sd 0:0:1:0: [sg0] tag#2966 CDB: Read Block Limits [ 2455.378588] sd 0:0:1:0: [sg0] tag#2966 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2455.387520] sd 0:0:1:0: [sg0] tag#2966 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2455.396473] sd 0:0:1:0: [sg0] tag#2966 CDB[20]: 9c 09 3f f0 09 [ 2455.411151] sd 0:0:1:0: [sg0] tag#2996 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2455.420197] sd 0:0:1:0: [sg0] tag#2996 CDB: opcode=0x6f (reserved) [ 2455.426614] sd 0:0:1:0: [sg0] tag#2996 CDB[00]: 6f a5 8d b5 e2 24 58 64 d9 22 ae d2 96 8e c4 c8 [ 2455.435491] sd 0:0:1:0: [sg0] tag#2996 CDB[10]: dc 22 70 cb fa 49 13 1b 5a d4 8a e4 d5 04 63 b1 [ 2455.444411] sd 0:0:1:0: [sg0] tag#2996 CDB[20]: 6e 8d c5 e6 51 03 2c d3 73 a3 02 2e b2 7c 07 53 [ 2455.453328] sd 0:0:1:0: [sg0] tag#2996 CDB[30]: 34 81 bc 55 a2 03 fe 7b 55 70 df 4d bf 2e 18 5c [ 2455.462246] sd 0:0:1:0: [sg0] tag#2996 CDB[40]: c8 d7 4d 00 7a e0 19 a2 1c e6 b2 b8 c1 18 57 66 [ 2455.471243] sd 0:0:1:0: [sg0] tag#2996 CDB[50]: 97 72 d3 28 e2 a9 be b7 74 cf 7d 1a 66 6c 85 75 [ 2455.480155] sd 0:0:1:0: [sg0] tag#2996 CDB[60]: 07 ba 1e fc 1d 35 1c b1 06 26 dc e6 6b a6 2b 15 [ 2455.489319] sd 0:0:1:0: [sg0] tag#2996 CDB[70]: 13 ac c1 a1 fe 6a 10 03 27 3c 06 71 6d fa fa 39 [ 2455.498247] sd 0:0:1:0: [sg0] tag#2996 CDB[80]: de 8c 9e 11 59 4d 15 03 cd a5 0a c5 4c 32 48 66 [ 2455.507163] sd 0:0:1:0: [sg0] tag#2996 CDB[90]: 5e e0 fb df 03 4c 0a b7 08 cd 79 c0 f7 a1 b7 b4 [ 2455.516076] sd 0:0:1:0: [sg0] tag#2996 CDB[a0]: b8 69 4a b8 88 2e 82 c4 d7 8f 01 13 ce ff 9c 71 [ 2455.524953] sd 0:0:1:0: [sg0] tag#2996 CDB[b0]: 9d 69 0b d4 c9 13 31 5d ff 7b e6 3c e3 de 3d a2 [ 2455.533869] sd 0:0:1:0: [sg0] tag#2996 CDB[c0]: 1f d1 59 6d 7a 76 78 65 bc [ 2455.737850] sd 0:0:1:0: [sg0] tag#2966 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2455.746696] sd 0:0:1:0: [sg0] tag#2966 CDB: opcode=0x6f (reserved) [ 2455.753066] sd 0:0:1:0: [sg0] tag#2966 CDB[00]: 6f a5 8d b5 e2 24 58 64 d9 22 ae d2 96 8e c4 c8 [ 2455.762083] sd 0:0:1:0: [sg0] tag#2966 CDB[10]: dc 22 70 cb fa 49 13 1b 5a d4 8a e4 d5 04 63 b1 [ 2455.771050] sd 0:0:1:0: [sg0] tag#2966 CDB[20]: 6e 8d c5 e6 51 03 2c d3 73 a3 02 2e b2 7c 07 53 [ 2455.779980] sd 0:0:1:0: [sg0] tag#2966 CDB[30]: 34 81 bc 55 a2 03 fe 7b 55 70 df 4d bf 2e 18 5c [ 2455.788957] sd 0:0:1:0: [sg0] tag#2966 CDB[40]: c8 d7 4d 00 7a e0 19 a2 1c e6 b2 b8 c1 18 57 66 [ 2455.797888] sd 0:0:1:0: [sg0] tag#2966 CDB[50]: 97 72 d3 28 e2 a9 be b7 74 cf 7d 1a 66 6c 85 75 [ 2455.806818] sd 0:0:1:0: [sg0] tag#2966 CDB[60]: 07 ba 1e fc 1d 35 1c b1 06 26 dc e6 6b a6 2b 15 [ 2455.815814] sd 0:0:1:0: [sg0] tag#2966 CDB[70]: 13 ac c1 a1 fe 6a 10 03 27 3c 06 71 6d fa fa 39 [ 2455.824761] sd 0:0:1:0: [sg0] tag#2966 CDB[80]: de 8c 9e 11 59 4d 15 03 cd a5 0a c5 4c 32 48 66 21:55:52 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) [ 2455.833706] sd 0:0:1:0: [sg0] tag#2966 CDB[90]: 5e e0 fb df 03 4c 0a b7 08 cd 79 c0 f7 a1 b7 b4 [ 2455.842663] sd 0:0:1:0: [sg0] tag#2966 CDB[a0]: b8 69 4a b8 88 2e 82 c4 d7 8f 01 13 ce ff 9c 71 [ 2455.851666] sd 0:0:1:0: [sg0] tag#2966 CDB[b0]: 9d 69 0b d4 c9 13 31 5d ff 7b e6 3c e3 de 3d a2 [ 2455.860620] sd 0:0:1:0: [sg0] tag#2966 CDB[c0]: 1f d1 59 6d 7a 76 78 65 bc 21:55:52 executing program 5: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) timer_create(0x4, &(0x7f0000000000)={0x0, 0x1b, 0x2, @tid=r0}, &(0x7f0000000040)) io_setup(0x1, &(0x7f0000000300)=0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r3, &(0x7f0000001440), 0xfffffc41) r4 = open(&(0x7f0000000080)='./bus\x00', 0x1410c2, 0x0) ftruncate(r4, 0x88001) write$P9_RXATTRCREATE(r4, &(0x7f0000000040)={0x3ba}, 0x7) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(0xffffffffffffffff, 0xc01064c7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f00000000c0)={&(0x7f0000000080)=[0x2], 0x1, 0x800}) r5 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100)='/dev/input/mice\x00', 0x840c2) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000080)=[0x3, 0x7fff], 0x2, 0x400, 0x0, r5}) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x2}]) 21:55:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) socket(0x2c, 0x6, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:52 executing program 0: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0x6c, &(0x7f0000000780)=""/108}, &(0x7f0000001380)="59a595a8c65b", 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) getsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000180)=0x70, &(0x7f00000001c0)=0x4) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000680)={0x53, 0xfffffffffffffffe, 0xc9, 0x3, @scatter={0x3, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)=""/124, 0x7c}, {&(0x7f0000000300)=""/159, 0x9f}, {&(0x7f00000003c0)=""/76, 0x4c}]}, &(0x7f0000000440)="6fa58db5e2245864d922aed2968ec4c8dc2270cbfa49131b5ad48ae4d50463b16e8dc5e651032cd373a3022eb27c07533481bc55a203fe7b5570df4dbf2e185cc8d74d007ae019a21ce6b2b8c11857669772d328e2a9beb774cf7d1a666c857507ba1efc1d351cb10626dce66ba62b1513acc1a1fe6a1003273c06716dfafa39de8c9e11594d1503cda50ac54c3248665ee0fbdf034c0ab708cd79c0f7a1b7b4b8694ab8882e82c4d78f0113ceff9c719d690bd4c913315dff7be63ce3de3da21fd1596d7a767865bc", &(0x7f0000000540)=""/223, 0x7fff, 0x0, 0x3, &(0x7f0000000640)}) 21:55:52 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0xff}}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f0000000640)={{0x21, 0x2e}, 'port0\x00', 0x0, 0x120004, 0x8, 0x1f80, 0x1, 0x0, 0x4, 0x0, 0x7, 0x40}) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) setsockopt$CAIFSO_REQ_PARAM(0xffffffffffffffff, 0x116, 0x80, &(0x7f0000000700)="c09d29171201053980ec335cab837c49d711b3ec51fe43a584d4e4f0c64250868c205021c755a940e21fead52f7ba8cbbc81338ba34f58eb3c045fff23bc8ea84c493222f343c2dcdc72c611ca3bdd77638b64c157cbaa04948e5d3892335f46f877dc84531677e035cbc193e25216ab6df1e76c5882d29509c9b0de4449f91cfb4d1e53e50a6b605303744a423d67152ab76d1943758d973593", 0x9a) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000540)={r2, r4, 0x200, 0x5f, &(0x7f00000004c0)="d53ada927e383cf2a3515bbfba3c54eca7fdad4e3a6864a2cbe2680088e4948ad3981bbfdda29a28bfd01183928ac816b9d9018244ef7b26cf80a682c48cdb02bc175b73d83382e24f07e24cdfc1f4c463b30099f7c9c6514e653a0af51914", 0x54, 0x1, 0x0, 0x0, 0x9, 0x0, 0x9, 'syz1\x00'}) write$vhost_msg(r2, &(0x7f0000000000)={0x1, {&(0x7f00000001c0)=""/222, 0xde, &(0x7f0000000340)=""/225, 0x2, 0x3}}, 0x48) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) recvfrom$phonet(r5, &(0x7f00000002c0)=""/18, 0x12, 0x10040, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NFT_MSG_GETSET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0xa, 0xa, 0x100, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x18}]}, 0x1c}, 0x1, 0x0, 0x0, 0x28044801}, 0x400c000) 21:55:52 executing program 0: write(0xffffffffffffffff, &(0x7f0000000040), 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000500)=""/179, 0xb3}], 0x1, &(0x7f00000005c0)=""/127, 0x7f}, 0x10001) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000400)={0x7, 0x7b, 0x2}, 0x7) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x9}}, 0x0, 0xffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYRES64, @ANYRESHEX, @ANYBLOB="62aab08ba35c9e2bcf8238f2c4070233ddc5bc9fff6204160b19", @ANYRES32=0x0, @ANYBLOB, @ANYBLOB="81966b1cc7625eaae8a4c5c3b3904d19f5711117ac13166de16b437564644a9d640fe34dd76d5e203e5f9f20770953f7beb45c068bf42172dc2fe39fbd7fabccb6071019319cbe"], 0x6}}, 0x8000000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001d80)=ANY=[@ANYBLOB='0\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32, @ANYBLOB="050010004c5d0100627066b3560055a3"], 0x30}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYBLOB="b8000000", @ANYRES16=0x0, @ANYBLOB="020026bd700000dcdf250300000005000200000000000500050004000000050003002b00000020000180140002007465616d3000"/62, @ANYRES32=0x0, @ANYBLOB="050005001f0000006400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="0b7d44ceecd67067e0ea6dc480ec54da6b957bf1effb590564701e08ef6630ab992b00af5abeed", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="080003000100000008000100", @ANYRES32=0x0, @ANYBLOB], 0x11}}, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cachefiles\x00', 0x40, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x20) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock\x00', 0x200080, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r2, &(0x7f0000000180)={@void, @val={0x5, 0x0, 0x0, 0x0, 0x7e}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x381c, 0x0, 0x0, 0x0, 0x84, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f426e6", 0x0, "3237fb"}}}}}, 0xfdef) 21:55:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) prctl$PR_GET_FP_MODE(0x2e) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0x1a, &(0x7f00000000c0)=""/26}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, &(0x7f00000000c0)) [ 2456.354952] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 21:55:52 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) io_submit(r1, 0x3, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040)}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8, 0x5, 0xffffffffffffffff, &(0x7f00000001c0)="f796814acddf464dd54038aa24334c8b32f9fa8516319964c49f11098fc64186bda9d3d18d6c2ed1417dee03c35efb2d53b2c2132d57e627d08da5bb1ada741f3571d5d3b09209c7446d3d670a0b40f7065aa69131354a463cc147d611d24aaf67a5c9854f05c65acc365ba98df25018567cd6897f7a3cd08f035569006883438289cf17a389dfeb35ecde03e30984239310b8eba2da9da0309ef61faaaacf269bc54e8033e6429eb474085afbd1164ce339b2320f54662812bd8b3586", 0xbd, 0x2, 0x0, 0x0, r2}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xfffc, r3, &(0x7f0000000340)="4fc6055579aa18ce83ce8b76a553df38f51e1046eba851fed748e24d164e12f89fb82165cc4248c5ce509d989cff289ac8938f293e855cdf300deaa72d9b945ab8a6d2814c2e28dfc2fae2938e7e358da45fa0bd59b04077199d9e62e84f3523e03db0605ed184ae5b4dba1cc36c475628035be99c40fa5a021b2c24efce16eab0f7e510d365044bcacc9ff7f7f45d749924fab576aca785c6926084787ea283eb386e10e58422b79090ffd93b322b79d43755b098b4e7e95ed188aa52b2448c8c227ceac650b833e233205fc440a18168a464185811befa95f798", 0xdb, 0x32, 0x0, 0x1, r4}]) 21:55:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f00000000c0)=0x10000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x22, 0x80) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x103000, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f0000000140)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) connect$l2tp6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x7, @mcast2, 0xd7, 0x2}, 0x20) 21:55:53 executing program 3: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$pokeuser(0x6, r1, 0x7f, 0x3) [ 2456.734870] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. 21:55:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x20300, 0x0) ioctl$USBDEVFS_CLEAR_HALT(r1, 0x80045515, &(0x7f0000000100)={0x0, 0x1}) ioctl$SNDCTL_DSP_NONBLOCK(r1, 0x500e, 0x0) 21:55:53 executing program 0: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000280), 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000300)={{{@in=@broadcast, @in6=@empty}, {}, {}, 0x0, 0x5, 0x0, 0x0, 0x1}, {{@in6=@loopback}, 0x0, @in=@empty}}, 0xe8) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0505510, &(0x7f0000000540)={0xa13, 0x3, 0x1, 0x20, &(0x7f0000000440)=[{}, {}, {}]}) syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xffc00003, 0x1, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x90000, &(0x7f00000005c0)=ANY=[@ANYBLOB="6a3ea17c39e031237e15e46886e9537071f775fd69c0c378ef572e69abd3fe450ba2bac234fa6cd8a438c9ae513bb1a50ff2da226a5b5ba8bb17dbda907b3e60bc0454251521405074c78d435ae139e200cfff24c7487cc65bb71b2dfe15f3183afef6d8c7ec8d41ba286970888df7ab8b3412fce987ff18ffb1e1ff301c4f6ae592710000"]) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) sched_rr_get_interval(0x0, &(0x7f00000001c0)) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount(&(0x7f0000000680)=ANY=[@ANYBLOB="2f6465762f6e756c6c623000a5270259d07650a49875d884d4265921af0a6433571dd8e52da58fe8927cb2bc4aa021f1b7aa51e05d51d22cd6a39d9a6c46abdfcbba0727fc793ee1fe25874c4119a8c11bb627ea8e1817930f752bf81c348c9ba975d1125f202016fd476b8607e0e3d090dc5507d204ff2bda292202d2240906ded757c6156e32e8ee94a40d9dca3e53dcdcae1c6e83fd2e960d8f2b6c48b954a3935802bcffe7524a5a160000"], &(0x7f0000000200)='./file0\x00', &(0x7f0000000400)='xfs\x00', 0x80a, 0x0) syz_mount_image$iso9660(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0xc050787274, 0x0, 0x0, 0x0) 21:55:53 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$AUDIT_GET(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3e8, 0x10, 0x70bd2c, 0x25dfdbfe, "", ["", "", "", "", "", "", "", "", "", ""]}, 0x10}}, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) fremovexattr(r1, &(0x7f0000000200)=@known='system.sockprotoname\x00') r2 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f00000001c0)) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000002c0)='{keyringvmnet0\\!\'\x00', r3}, 0x10) 21:55:53 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r3 = dup2(r2, r1) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000000)={r7, 0x1, 0x6, @random="e671d4dc2853"}, 0x10) [ 2456.985067] scsi_io_completion: 3 callbacks suppressed [ 2456.985106] sd 0:0:1:0: [sg0] tag#2966 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2456.999528] sd 0:0:1:0: [sg0] tag#2966 CDB: Read Block Limits [ 2457.005522] sd 0:0:1:0: [sg0] tag#2966 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2457.014576] sd 0:0:1:0: [sg0] tag#2966 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2457.023610] sd 0:0:1:0: [sg0] tag#2966 CDB[20]: 9c 09 3f f0 09 [ 2457.038467] sd 0:0:1:0: [sg0] tag#2966 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2457.047479] sd 0:0:1:0: [sg0] tag#2966 CDB: Read Block Limits [ 2457.053425] sd 0:0:1:0: [sg0] tag#2966 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2457.062363] sd 0:0:1:0: [sg0] tag#2966 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2457.071316] sd 0:0:1:0: [sg0] tag#2966 CDB[20]: 9c 09 3f f0 09 [ 2457.124592] sd 0:0:1:0: [sg0] tag#2998 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2457.133549] sd 0:0:1:0: [sg0] tag#2998 CDB: Read Block Limits [ 2457.139606] sd 0:0:1:0: [sg0] tag#2998 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2457.148540] sd 0:0:1:0: [sg0] tag#2998 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2457.154634] sd 0:0:1:0: [sg0] tag#2966 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2457.157500] sd 0:0:1:0: [sg0] tag#2998 CDB[20]: 9c 09 3f f0 09 [ 2457.166242] sd 0:0:1:0: [sg0] tag#2966 CDB: Read Block Limits [ 2457.178153] sd 0:0:1:0: [sg0] tag#2966 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2457.187213] sd 0:0:1:0: [sg0] tag#2966 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2457.196164] sd 0:0:1:0: [sg0] tag#2966 CDB[20]: 9c 09 3f f0 09 21:55:53 executing program 0: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000180)=0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r1, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r5, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={r6}, 0xc) getsockopt$inet_mreqsrc(r4, 0x0, 0x28, &(0x7f0000000280)={@remote, @initdev, @empty}, &(0x7f00000002c0)=0xc) io_submit(r1, 0x2, &(0x7f0000000340)=[&(0x7f0000000000)={0x4, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000001c0)="100000400600"/16, 0x10}, 0x0]) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETCARRIER(r7, 0x400454e2, &(0x7f0000000200)) ioctl$KVM_S390_INTERRUPT_CPU(r7, 0x4010ae94, &(0x7f0000000040)={0x1ff, 0x4c42, 0xfffffffffffff001}) 21:55:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000140)="59a59588c65b", 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x208080, 0x0) 21:55:53 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)=0x9c) 21:55:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000240), 0x3d, &(0x7f0000000000)={&(0x7f00000001c0)={0x1c, 0x0, 0x40a, 0x70bd25, 0x0, {}, ["", "", "", "", "", "", ""]}, 0x1c}}, 0x10) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) read(r2, &(0x7f0000000180)=""/19, 0xfffffe47) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000002c0), 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x20004008) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r4, r4) syz_mount_image$jfs(&(0x7f00000000c0)='jfs\x00', &(0x7f0000000300)='./bus\x00', 0x3, 0x4, &(0x7f0000001640)=[{&(0x7f0000000480)="67bba578a9c740ba3a6f89e735eda1f861d3e550b5f74029ce90746aae994b36f117ff980a6e6b217ddd33b425464a731999c3a9a6c86ab327456969e7568e52c5ae4683f9018ef9d4864c437254338944c18bd2034158616e96b8d3ce7bb96a74cda9e26cbcc55445e259ff03977bf5dc096314fa49f8988959da8f63672ca1de6932b9610735ff2aa8ff468a7c7c5ff7a5770b5e021e72de36f7f83a96c09dffe0b378657426b0892fe9a6e8a4199ab8f948a863ba93621ae12a2f396321349e4b0fde966e7437d162dd3af482d9cf85fae347c4fdfb7a70e2f0e3f6", 0xdd, 0x9}, {&(0x7f0000000580)="d12be562ed686a840043678c2c7acf1e9a5ecf74eab47039eec2a139b0a5d067c149331d4af345027634eae2d15c9994152dc88e3c11d22117ae61ad457e3eecadf5d435eaf4a2b68163f8cfbf1f9424bd721015058f81eb94421052ea46e35c99b8fea1c727855ff400ef12c4d30287b39364b9112f119f6400140c2467211c162cc9a4aaa5ebdacb622ed3a9ec82f984788855545a5cc5250a9ae3e8015102c3fedba45a493d2d41a0d4b8c788d3b68d693128b90023cf743978d43cdb8df4e109f91257e5822fc8e74a2235bec18c669acba634ac5f7b25f221028e1c1bc3d4ee09f375468f0dacb02fd25725c08d7cd5e60ea73ea2da8813971616ada9117c5c57af7ad7999eb2755be0c842a3976adeb67f9e670c721501e2b5bc944ab239b98a3b4cca70d440b0caef69e356dae4760885f4b18ff3e4cd633c2764e94727dd5d9c34fd2747919d1e6ae632c472458c38867fcbb29389181efd2dc69985fe5b67cb99e39ec8b2a538f66f59746bd6516e2ab75cf36669c3de56cd694cac4ff44d9f289b16478c05f876df09b8d714575597341f109a7417991feaa9858d67ef9a0533880f810b6f7db47dabaaf7cb2eb203e9c3b22584cff39a660d0bccb71c6206af06449624a7c2bc96c8ad9035396a68a80fb951ab8152bfefdea12d492cef10888dab6313a0e7fd0bf231150ccd87924c4fd6f274d9520d3c8ade2294b2d411b7a7842c5704738fbb8db908149bce35e671cfd33472135bc07cbb090c918e3fae870ef5172f9c9bae053cad6dcc1ca51d77f9aa3861e5683a78c2ed4859add9e8d1eb8375bd9de8360babad452258cd7f25e01db6bba6890a41c4959e2aef25eeea4fb2d7f1a54b77fde533e3cdcf527f091d8c8a54dee89c3fc136b4096fb81efd5e699b53a5afb367fd61d9178289b0fabc2ef5eeb23ef41df566cce88c408bd7d692fe6de6583f7ecd42ff77049f95b474a4c41bc167fb600843afcacf7a2a6e23a72674e2b76d6995bf601cd57436c0a5a89638b3e624b8e5c4bdffdd140d94ea84b4da55fbac72d725a6d182446be552d16dad84cffe5cf5f413e871e1db8a7d1792499119960f406c8bc6db8d11da76f965cfd9b06a49829a110dad261b69a198bb7f95491a820921a4d737c2ec0e0334e738312ab8c9c8109b76bf92ebac84a55b67333c8efb063ec22f6755188aac73970dd3b396e01c28099cd2d2a519c39293129b6fccaed92e7454a98d8cfb5d65b3b9a662dfc1af1eed6e081c1cf0de5d3d544348ccf219a6acbd8f6469aef14337fe8fcd139cae253f36b4b787d8424dcc14589871b9903af2056f0c0c3d6a5fab1d6a141fd803cb9d67439e83337d2649fc1231c16fccde951df587d61ed48c6a04cbb021ba15e4b3adbbfe0f4c0831ae8faf93f0dd90f91b139612341e2e5e9c4dfa40a531ff3e1540d7b5cc7a675e40eb61017aa853c122c6eb5aa48eb001e785e3f827a1dcf888eecd8a9356719aa0288c6f7818dab8d47b765635d4ba4d1a0d3e8527bbaf524e94e8c050987116d4ce353c1de9dfd5de22080ce1c19ef97ead756fc66c1d9af196411ffc9db704780a9c8e414fe830c3d8d2b84474ecf805a76d5cec87b7e5c0029458159bf17594505555671c6f1ceb0a132693159b16bf22bd7ec08ee062ff5996783655316600d4e6c6d8be4af348970434dc67f6f809729e62da354f2f65e12a5ef75bf041515069e211040ce7996dbac3a8a0c0077a28e5ae7083a681e804d61384348870e00fb37e171e1ceffc35376bf9cc7bfe2060cda4b1e5445de1a75322e90ab02ccb82a639be7274ffb61ae06d6a401e2b7901535c6283eb038bf14016c9c835d775c93d5161bd603c145e62034b38fe07d3540eb1285ddc97b7b29084ea1f596e276f09ebf7ffe05524d0d853a5a369dfc4599d349912ddf3be4f04e4975ed9314210c70b7f07d9a861cc2453f973961cd452bb07d7c3eafa3e70ffee21e50da7789af088def5a95cbdf7c5806619cfd8adc57a0d1f2f2d0a92ab9cffd217bbf67ef35f4b79c6cda39267afaf03e3c9c974d4887ca6f5e654901a6aa94da0fa890aa4e26a11b364c3830f6fb75a55c0a3fbf8b349a4c123fa56a28ad6b387fefd5cbe70b2a18a29523e77693fc17577bf6e6fddc71ac6445b26b1edbe443b1a471278f93e5d4120366251b3605f546a5b4a3697c612c23e1267f9b863a0e76767288b3315cc2e618120807816349e54a0db407a5e0c77a214ead05d7250536aac9683e8ff8eb856f7ab4dc4c5a2197ef5bc21b0ae1cf73ef696fc85a4cd0c01a9cb265b18ddedd4ffb9aaaaa973485fc0b62608efac5c0062962e57b7a96b0e374560c2331fb17bbf76b5c734c2db3327b4b71f18438d48f7f0a5b71519d830a4a7e30298f6fe050b2d9bb87ec170113aa3f36326b89661bf39d386ac4cbae741d41063c9cc8e26a92d63d2ae1e3998ff317800cef2c89924c5186785524bca55f3514e1a6513de0e0569c81eec4f9ebd201a3c304081ed28acd5ef9f95f3dc78945435b58564b98cf32ae5c9253a3423bab1dbd374ac7086188cb0aabb4f96bcacb318a9cb1faad78022bc610461efe1900d3aa49872b04a85f794fd4bbc0e34b08fbf917c28679f4a213b563fcc518a0d642799e4d315389fff70aecf52464978625b6f2091f7f4107669efe5eb377aab1e83bd9cc9f05ff1fac07371a91fd58af4776aac0d9915c1f932a2f0a872e28c5311ea91fc4933710639b2541c4a5a97bea2171724e36cc7c8f85db882b7f4fe45179cabd4f1c35b31804fdc9aa1534a6affe22d913fc38b5d27801fe2d7bb938f183a8db788651a2c51f4942be111992100dec49b25561c8a99cd9e2224771b6e5f6d4a921e70b9a2699a36a8451cb07f65b6f70e2480905b84f3825ebd504c1cd1dcaa6cb84aa65dd332691fc43fc89d1cec87d870f49588440aff7cf392b45ffcbd6aee1a00790af870e9025f4ca000bfdb2ec1c5eec1ef365673c37c7ca48d56d958c0838d5037df80925a14640306a385db050a778a525fcf033aae90800f296d315fa45feec9d90ad74c536006de3350ecfd4a11e06a11f512c549fa16055283e24e2283e51e6b82f65b5509657453a0a2e7f4f48136ccdccbd211077b476cbf0f551a79694d6dc669b92b821a595ef5897fd3ab6d06daf4983c5b58795259ab3f2ef3d6f1e315d0eb2e1a1c1c55c337ec0976fe1ae16014d0c75396c8b939446c0c9215fbd3a0b2a5cec7cb5b1e07566c4f9e4c0c72202a0b47e2e91013a51d4d59cd5e541607d0ad6aa09161afe69e6ad015e6ad790cf26c021ff5b8c86c0eb520fd350dfc0d9756cad2e7e3027961d048fd1f6a4229e5bf87c07f66dc31005c1ce971c4b18ecc4a4f3c10d1da42dc3e124d76b7350005bac77dce15deda18324c8b22043afd1b1f99f65a4398b8f48ddc362481ab2bde6bc72ee36d4082cbc39c47cf0874675cb120fafa8ad597cfac49ed6ca52175ab4e48e6626e8d0d3773b72093f4f1e49c2e111c8a6ad7b68d51074a2befd23d53b1a134d6a19d17fabe7adfc5a62d7a4c9db712e64cf1bd06b9d943b4d0238605795e10a6702e405434363ce8055393b4301b22ea546bd051684f795addf33158345dc3c51073bab22a5e12fa7e8dc1fdc5ad9b2c540ff6d3af8c1c59bc7b9727b38425342079ea7355f3353012fe6da01d4d13b917b8a730a9da7619c0a6caacb97a41ed564370c4f4efb9b7c1d3dc5f8d05a471fecc92290f819c7acd48a4112a07a0892da3b6ed48f75cf3d48b686a257e06466c32ca61f0a24020ab4845fd97132caab9405623e2a7dcb02f7a1b14e0ca13cee42d1bb18c888b09be3fcadb202e9d9f87e0afef8f2fd63ea384a1070562ade9691213e93d7d2faae653c1e8d6dda29c999344e8ecf56638f4c9dd149f05013bb4d4ee03f7088bbf2fb7238c12e7b228eb9f759f55db5c29d33ba67c61ce68761ac3cee23c282bbe1ed22f5f8741229e32c02ae0a683c9e2a74bb99b1260e0de1e6f684432fe0a80005981593a2005147faebb3601a3630e3cd14c8255cda1418ae3b1d77dccf24f1272123d6870e4dc7251fd143c3cef71ed6059707b80469d0b5d99dd13933bc629e2fee7a670eeb585a4eadf82dde0f190d419527bcb980139134121bd5edd096ce07dd46d4473be0fd8407f81eed84e1db9df9bc769fa0fad33a2276cdfc746f35860db9ba14a7aab152e78cd76fa4fbb4d0b142a5c3e6e79cabced01dda68e73a4895cce8331c3c7442a4535c8a033e4e36ee181cc37e6355287d2c4231ae7e31fa748dbcee96f7b379fb1a03fd894349714d4ac0ce13cfd826e21e84348014b48e7f5c54731d60428fb429a5cbc1faf036e5e71a3cc8c75e84e7be7f1aeb9b5e49e6b3c4637817c356926be11c3b0ae7aa51e114c0752063cb4750f45583331c2d7c5e166741170ca38e50dbab4f7a3a62742588a5b384743a26563b596cd651eb98ecd3f455710c610c33c268db953ebdfc395419c42c57b77996c9e369c6d28fccdd7a1ffb87a23879714f38eef08da819b2281fd8a77b608ea5af80798f5e8669915095751531ef797162597881acfb8ede0401248463d3e3dfa6af0c798605e361ccae56c122fb705e55ed07b19dc0fafdad5c99df592a51be876e94c7c29e106f4ad77f1268b766979a0d44961ff348813ef9dcd9d97e82c392b4996d3ff72340349ac691dad72fe51be81ec86ec50ec5772309ae9171138c0c906a27271eb443c133f651fbad13a714d29a38392f93e713e81ec556a39612e4ad1f368d106b706c374f2f17cdb09506c6f2b6fd83f389449dc8ed43eac740e3878d3c9d305af847a288df9722349e92d983e191fb9cbeeae1d64c6780a42c246a78e12d44519e49b561bf080b2793dd0ac736eb9ab519b78e3899c2cfb05640643a1621b17ea0c065d6fdc74ca45264969f5f94e58e2195ca662afecfc0b2a51ecc06b19b75e5ecff597ed301dc11bda5c819bb2b3da01b4cc1e8054507563c3683d5b97b17cf34e93d87635122709c0c407055bc5a96fefbd2525c8b2e24941e7c7a2c2dbd02a5d6948e3cc10b6a3337b04e4df149d9142b82534da9a73dbf84cf49010491f6f8935f8de135d470161fdeb86e1526d1074f975b8a78c955e8b350cc22adbd50d5aaefd23f51bd9a106de058b7ca6b3c4e7007275609ec44c996eba7456cd0580c520e1b7cf8147d0ca5828d63832765250079e7647ee0a3a97e74d23b78af611252f9a9a2f9fc95385f75508b8f35665eced5d58a4f5c1be9503de36457f8cb70f8a5354d41109bf19fee7478a5d7074683fa5b37eda2efabd17cf13b2dc26215fb3b629bfaf3832b80b3fab4add4da0fa11ba1364ca8a5f5277c9aa98808a7c016d474208ec6569f2b27017dd33d3fdf0d90a8f7e1f6c1f1059b9ef6cf5dbb2c74010431c60c808e0c902975ab0bb103ca6af86210a0b2094fa13654315306877aeca55ebdf80d1ab7366d1a0bf23f438262b8a842e46bdeaae791567e7471b886520002e11063633d4970cf7b3eec4aa284c940b225505ea9db104fdb1a9fc70511d1fe75ef083cd85f4a7c5422477b05f09f8c9084210d76dca99c27c6e8a92b6275847825f57633a6adf1cf6fc3593118404d390cd1324795f260e70f919dadfdfda34ae462d2dc073b6767e13d6949e5e920148204237ecc8ba4d39e2ea9df53818d6c7c35c93fb30eecd7dcbd43fc4792f3301717fd9461e14f064c2e8f716023bc5dd075a0cc6e5", 0x1000, 0x4}, {&(0x7f0000001580)="09733e0d506cad93158b2fc740da5b60b57f59c346b689065307484e0e375929f0fd3f288a1af4a1341c4fb90e8b06d493e0a4e325e57c1696c6181d17e434962e1fa661424339e9cffe821cb37188109c619dab370681f1b3d5db115736d8ad8be8b3115a471efb7759e7c7dd4c2ef20b18a5c1c58880ef8191199b42ebb59685f8ba5b39e9d0c21605", 0x8a, 0x8}, {&(0x7f0000000340)="1d561009a40dc3f3acec2f8de284076fcee4dde1ea8d70fd95baf20356e390347a20ad31d4f12a04dbccc134e11a4d543f78f9fbdf9ce835c9847bfed9f7", 0x3e, 0x7a}], 0x1084000, &(0x7f00000016c0)=ANY=[@ANYBLOB='umask=0x0000000100000001,umask=0x0000000000S00000,integrity,smackfshat=ramfs\x00,fowner<', @ANYRESDEC=r4, @ANYBLOB=',\x00']) 21:55:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x8, 0x0, @scatter={0x8, 0x0, &(0x7f0000002600)=[{&(0x7f0000000180)=""/80, 0x50}, {&(0x7f0000000200)=""/29, 0x1d}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/228, 0xe4}, {&(0x7f0000001340)=""/148, 0x94}, {&(0x7f0000001400)=""/212, 0xd4}, {&(0x7f0000001500)=""/219, 0xdb}, {&(0x7f0000002680)=""/4102, 0x1006}]}, &(0x7f00000000c0)="00000000f0ff0000", 0x0, 0x9, 0x8df26b74761c5802, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2457.568047] audit: type=1804 audit(1588542953.825:1187): pid=15202 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3585/file0/bus" dev="ramfs" ino=295549 res=1 [ 2457.633570] audit: type=1804 audit(1588542953.835:1188): pid=15202 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3585/file0/bus" dev="ramfs" ino=295549 res=1 21:55:54 executing program 3: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:54 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) ustat(0x0, &(0x7f0000000000)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timerslack_ns\x00') r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = openat$audio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio\x00', 0x103041, 0x0) sendfile(r6, r2, &(0x7f0000000340)=0x6, 0x5) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1d, 0xb, &(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYBLOB="000000000000000018260000", @ANYRES32=r3, @ANYBLOB="00000000feffffff181a0000", @ANYRES32=r4, @ANYBLOB="0000000000000000182b00004d1b61ad7810d3dbe70f5bf9675d9ccc37b11105321d98773e5bd00e02fb05f6a9c4", @ANYRES32=r5, @ANYBLOB="00000000ff0100009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x8009, 0x0, 0x0, 0x41000, 0xc, [], 0x0, 0x3a51c1b3a9c46c18, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0x1, 0x3, 0x800}, 0x10, 0x0, r7}, 0x78) 21:55:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_IRQ_BUSID(r2, 0xc0106403, &(0x7f0000000180)={0xffffffff, 0x4f7f516d, 0x3ff, 0x7}) r3 = accept$inet6(r1, 0x0, &(0x7f00000000c0)) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) accept$ax25(r4, 0x0, &(0x7f00000001c0)) syncfs(r3) [ 2457.695641] audit: type=1804 audit(1588542953.835:1189): pid=15202 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3585/file0/bus" dev="ramfs" ino=295549 res=1 21:55:54 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'veth1_to_team\x00', 0x1}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x28) mq_timedsend(r1, &(0x7f0000000100)="a616a1caae636c92f81f9bb2b55aee3fe78e065405663ef9ccb565441fd5675a8beeda43ac78ea80ce81d028c3b3fe4c5ca6043e9fb2dbb778a0bb57726947d720c7b8b65c90f5f8e4fa6bd97c563968c96b60e16e7bf38eea0dcb4de602e083d6fc19637636055bd34923c2053ac62a4e2b996e89730e9ad972c0f9b77114b1392bbbf6e1a651733e93bc41f39909e7786d0e008c6c0ecd5db1e4c705", 0x9d, 0x0, &(0x7f00000001c0)) r2 = creat(&(0x7f0000000440)='./file0\x00', 0x100) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RRENAME(r2, &(0x7f0000000200)={0x7, 0x15, 0x2}, 0x7) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r4, &(0x7f0000000640)={0x13, 0x10, 0x10f, {0x0, r5}}, 0x18) write$RDMA_USER_CM_CMD_JOIN_MCAST(r3, &(0x7f00000002c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000280), 0x0, r5, 0x10, 0x1, @in={0x2, 0x4e20, @multicast1}}}, 0xa0) mq_timedreceive(r3, &(0x7f00000003c0)=""/30, 0x1e, 0x3f, &(0x7f0000000400)={0x77359400}) 21:55:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, 0x551}, 0x40) r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000000)) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x341001, 0x0) ioctl$sock_bt_hci(r1, 0x400448e4, 0x0) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8001) epoll_wait(r2, 0x0, 0x0, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000100)={0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) 21:55:54 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x2, {0x0, {0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}}, 0xa0) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000000)=@req3={0x8, 0x6, 0x9, 0x1, 0x1, 0x401, 0xfffffffc}, 0x1c) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) getgid() io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x3, 0x0, r1, &(0x7f0000000040), 0x0, 0x40000000000006}]) syz_mount_image$nfs4(&(0x7f0000000040)='nfs4\x00', &(0x7f0000000080)='./bus\x00', 0x100000000, 0x4, &(0x7f0000000400)=[{&(0x7f00000001c0)="37bf7d9c016ddf9d050814246a4643dd6302510a9651363e22eeb82fbeb3938288ee215bbbccccfedb7dcf7060fdb1b0651b", 0x32, 0x2}, {&(0x7f0000000280)="7205e7a4a9e7791388a23d8e94c49e346a8213954db128163e8b22478cf07055047acc59bcb54ed4a430c840f209a2481714f4e892edd9423b7c708e5a21a7bcff1981210c", 0x45, 0x3}, {&(0x7f0000000200)="9538d812babe157c39427f6c2e0ff8fe3828fe401078249cec57c8bf1266029c68628e27892d250eabc3642d7de3ad599eb05697877cd699b91f785d8558a3", 0x3f, 0xffffffffffffffa2}, {&(0x7f0000000340)="708755c2520819373af4fd912304f04ef4b99deb6c85f54a01f48085e05c240b1c3456b130b60f250e14a3f5f1cba6dcf52b79fd269a6a0151adf6679c9e1b5f0eb8e97e025bf07533984c69c05bd2e6e89780f3c9ee9821e1b4f6aa0dd9cdf93db48d44a99fd14866bdd809b5746a1f4d92486c39e611fe5c8dec95e7e178014e67d00cf0c034c856f01623a80c0eb05057fd320a623dd312ddf9980a4f2b38f55a58808b9e8bf2eaafa0fc6f1b01267d6a4bd8cb9e2a99", 0xb8, 0x9}], 0x2000000, &(0x7f00000004c0)='/dev/net/tun\x00') 21:55:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r3, 0x1, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4008802}, 0x4010481) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) sendfile(r1, 0xffffffffffffffff, &(0x7f0000000580)=0x3, 0x7) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/net/pfkey\x00', 0x8201, 0x0) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000480)='SMC_PNETID\x00') sendmsg$SMC_PNETID_DEL(r5, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB="003258db", @ANYRES16=r6, @ANYBLOB="00042abd7000fbdbdf25030000000900030073797a3100000000"], 0x20}, 0x1, 0x0, 0x0, 0x4044801}, 0x20018080) ptrace$cont(0x20, r4, 0x0, 0x0) rt_tgsigqueueinfo(0xffffffffffffffff, r4, 0xa, &(0x7f0000000380)={0x6, 0x9, 0x3}) ioctl$USBDEVFS_GETDRIVER(r1, 0x41045508, &(0x7f00000000c0)={0x3, "e7ad06c58e27b327b4efd77d19fa631f84bd15a8f790e08770a2a0eebcf8543a05c5645866667ba0929b04228cbfb78be06808b885d3a333fbf38cc0207b593f11d655a33903f725970a081e62a02241ad3b5583b5e0b65d9258c65320e9f43949254542a69af8b3ba3853e89ee3172c0dd4e25c86cb94b182a7674d2022567f29d2cee154e2e1b9200b9f6daeeced192a472a7a3b6ee287760ce7fe7366a0cda4bb79c7484e8e69a76e21660afb01fda5452379e27b07d857a404ba3c2e1edaea0cda55ef2bb0f6a7bea2618b0d799edfe54a6b56e0a6e7ddf60f83e08c87be94a544a7d78cc512b4a4f0f975ee995ca29da400c4c0ad616486c997dc8d09b3"}) 21:55:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0x9) [ 2458.317779] audit: type=1804 audit(1588542954.575:1190): pid=15240 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3586/bus" dev="sda1" ino=16850 res=1 21:55:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, 0x4ff, 0x4, 0x80, &(0x7f0000ffd000/0x3000)=nil, 0x3f}) [ 2458.432815] audit: type=1804 audit(1588542954.635:1191): pid=15240 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3586/bus" dev="sda1" ino=16850 res=1 21:55:54 executing program 0: preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000000c0)=""/166, 0xa6}], 0x1, 0x0) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00000000000000000000050000001a0001006370757365742e6566666563746976655f6d656d73000000"], 0x30}}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140)='NLBL_CALIPSO\x00') socket$inet6(0xa, 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x1048000000004c42, 0x23, &(0x7f0000000240)=[{&(0x7f00000000c0)="800000003804000019000317e60100006cca8000000000000200000002000000004000007a40000080000000000000006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4807, 0x0) pipe(&(0x7f00000000c0)) [ 2458.499231] audit: type=1804 audit(1588542954.665:1192): pid=15257 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3586/bus" dev="sda1" ino=16850 res=1 21:55:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000200)={0x53, 0xffffffffffffffff, 0x130, 0x9, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="59a59588969c6e712d4a1429bbbe905dcff5a9626ed712998452fb2ba40c9a508519cb832baadbb4b97a73debeaf8d821c9f871bbc75d468d1c97b98c41ad3ed77de7036992011361fb3179f37a4ff7fd1000200004ac96f52b30d3f9b11124b479953025454dd501fd0946748da592b01475bf7e3d6243759a8fda03d32e04fe7013ba6288f21e2012a8a34675a16d4e13c8929551ecbff51026d6e22f0a4e50beeae72d1f932be8b6bc01b99110b6ffc71973457c5fdc2d6f11584d3cc68a280a70fc229771ea3ea0d70556c38fa14edbfefd80169004b89a6b38fdbc9a4001ef409ddcfd3e47bc99ee8d8279c2d7d8f4dfc25784229a4695fbf7667b43e976c567772c7766a5bb2b3e5240b3c2d239bfd34b960a9543800000000000000000000009e0b00"/304, 0x0, 0x7, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) recvmsg$can_bcm(r1, &(0x7f00000003c0)={&(0x7f0000000040)=@can, 0x80, &(0x7f0000000300)=[{&(0x7f0000000280)=""/72, 0x48}], 0x1, &(0x7f0000000340)=""/77, 0x4d}, 0x1102) 21:55:54 executing program 3: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:54 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) sched_rr_get_interval(r0, &(0x7f0000001a40)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001880)={{{@in=@broadcast, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@private}}, &(0x7f0000001980)=0xe8) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) syz_mount_image$iso9660(&(0x7f0000000100)='iso9660\x00', &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x9, &(0x7f0000001780)=[{&(0x7f0000000180)="46de009c4f6b0c71eecfc0f14336489c88506127942c834a940d24a85696585692947054008dff0acf6164cab39ffecf4c2aca3edfbb2e8572fb073053d992cf55202235e52547e441873a625d7688e218ae07b54e8c59574e758bfe984aafa50c3e89d81111a5472ad66dd645741c386e", 0x71, 0x1}, {&(0x7f0000000200)="ebb4b21d1f9ae6ef748521dbac60cdc7c3fd45785696aa4cd8dd0c0fd4c10bd1974b408c0a841f1832311dde849d1592a6e3bc45a0dc94aa23e779b6f763146d8b9e8a2e53ad487937bd0517206b8f725c846d752bbe66905aa72017c7a97f55e4ba29", 0x63, 0x2}, {&(0x7f0000000280)="8d3cf22334d2f59f24807ed669d88f275d2b8d23bdf4b42ccdfc12ea00efa950b8087a61ab87e7bbf82fab9b82ec444e2ab839eb18b0a40ebd652306d0d7e7df99096384175939005189f68be46b6679fc5b79c70e6e8072fd1bdcba9e2abe6de098db7796f7363eba6e44928e0c578a604058891e0d27ff939c5d239379c3e18dd1c51123d548284d8e2fd403f73c96d32addb8bbc1a47ce5f7838ac12f4c8132caa9296465c284cb5e65744907a50d3e5ec996251fc070a352c7c91372855ec150cd93561ef9554988aa286ea18b44da78d3aa9a477743eb8a1158ff879d0d12e947221b6205fb7c46119fa63d2e14878542f2df05ceddf1f9d5ac5c1f454ac125bc2b555bbf259938d1fd6c9935344eaa5851a6a3a76721c07536ad355190e19d80828c8004f00bacc418e3a8dff72ac0797d847429b18f41059b3487d176ded1301af1ee2f6c8b69387ce20ca8e633c7f103beec833f3b4640188f1c8f60bc22480c19b48ebf0b59e892a6e9a17e6268a34edbb4b1bf523b861903d5ea5826afac64fa0cdce7f1d6d3a6bf1bca250922fe495cb8e36cd1a424872b968bacead3b8ddc28a2309469897815a0e5916bf1285d8afd661cab51e38f8449f27c8432483117a67a6fad300c950ac2b218c140fdd27eba4938453e2d259ce7adf141ceb8978f2c51de51a31ff2d916d6c3b2a79c9f9850617b8199be0f78f1bc34ff034e50fbaa203135648907ff934fc525995e7c8fdeda6ffb2a3bcf0169fca5312d3486ee44d8664acc29c0ae0d11ccb47d80094f0181f8e1f5e590d921b65e40e4a2b08f0e1f89626bb006b2b8f2ef28da67ab070d5a8585163e20b151f49362226eb26d6b38ba8c0b91daaf01e44ec8c4a450601cee05bbb1e43e8814f395987dcc94ed6c26fa9eefdd6090548241510609ac4149f1b994d15dda37da7fb632f6ca715a295b834f6c82f09f3920f8808649ac64b43fd2125235336ac197c3aaf9a8a1bcfe5151c39f9b0c7049b2987089bada21ea2673a9731235dca6f0dae5eda2100fc33cde01382b7d6510a11b23ffaa3453a964102dd9dbcc05dddef9e05d4a32e5e488be2177e102afe342802aeb9ca0b2f7a13a6661e11a4f17e93bda326293de6f642f0885ccc2a92a1e3a5cbe57de2b55c9172efbd1a9b917edf2fb48ffa1bf7f5139bd530fe004bc02fec6a513d0a0dbebfe990fc675c8a71daef1749d1d00b2ffb429023614ea54b5398e07b7892ca7e1aac6836efcbdf42ae258a0cccd28605bfec08803627916047631a00594dc3ff74ffeaf3990b90d7bf02e6417a8cb3430ba6028691c0b0268d2f2b2170650126d5f37a37e1bf2682f2ccaa5070b47ada02087a0db6f91f4d97dea253e965d080a46757bf13b49ceff35037b5ffa8affa8a58116ad7e379949516d15c237db8dfa09f84380ae26cdcb7fb86f7d766d05da0889b741e16ceb7f3afb18aac5205c01240004f7754c926fc6b2632ca4572d675e6a6306ebdcf130aa7cd804e14e2797b95d25ab69aa572b60090555e70a7d242aba3eeebab09fdb909a97e8880220eae2d37b5278e1b0e101f204f60f7ad11d21532217b609186c33385fe12cfbdb12fade64d1477ed6f9e656b28ea5ddf51e2c76f0441d09dfb0ef5fe8aa0bceba694de4b628dc842f64556ae45084a2ebb969bbaeb5ec59abfc94ca961f1eb615c9c5d09e591a7dff95cb056164746198dcf96ad97e1d2dd6a6f7e16f05772825b35bd26bef6374859a71ebb6ba2c0283f2992652ec918fdc10404b0d27a1347ca93d86def0e548a75f7c5837872c61371139667b441fe747c65bf6020be22a9cd7fc5aceeabcb2f4bf1a34a3ba67c381adc4c3ab1167beff3ae0507d4d4e9e7d9100c17ca8d382dddc16982ee804a48b05a8e18893107a4b725f5fa349b9806e9d51f4860af4989f89cbede4cade7c8aef1c5ac48df25c34410bed9eb5b9072c0b7383443c56dde2443665aae3cf8c600a1b709b278a619d114694ae90b9fb971c3d28589a0d24e7c2ac284f9a697b2ff42690e4a62d88971e2afa7ec501608eda526972147e83675aee1967a31fc1b5d9e2d806b3436f232923c2ccea912c4343a37cc9d63c0148b90fa8ae3c2dd7741473e3d5de587988fbdc11f14b965c09c3e1486fe3959efbcc4eb452b5e2d575370965effafbe7a18a423e6f4de74ede8658ece4873688066480f10d1d539fcacd6f9d362e8ca18c72994f633a076fcdd81340b4d65b36ae343e5ba067c83e371322277efae07cdc3f393c5a56b392ae84fdec6226c9de45bb2abedd29b6bf6a772709467767e007da74d498b9fb2a7dbeff215239ca94cc0b037f1a430cd66e7a75e69a2019481e9cc11e6a8c31e7241957412bf4c1e18cfd2a5bfa959b372fb1c67c17135a9d00786d3410d79c9a6612c791f36d87ee7999103ff08e4fd27da03d7481381d86ff9a834dfa84aefae4a0a847b94e221a69098fd64162c8963a7fba93c0d6d00bb23818e852ba0ae830c1f92a0cb26277edee56c07275fe8205638f9ffe4c3d419b9096d4c3616c089f3b07a7bf0a68fb8d6c8fb3a2e3af701bc7f1226af1a50d2f0e55f0067435794326afcb7ca9a3024c0e6e40098f4c9b62670e662d56662746fe7f4b8351ac44e77499f118543397cc488770c386c7faa3e7fb7930820e019491b13ccacf44538756c1f5f3f32a6c9f120f188ef07d8cc842729a32b9e8c9dfac5b70bc58d17a777f3be29f6db2f7142524eff67f30bcecccfaefe43c6f0d53dc5cdda5b41609c471b65c770babea26dc66420eef442779726d8c2ff5c9bc2f7586bee5a9856bedf13371b0d8160fdb36003e31ca110ef50011436f33bfcf3bbfae3e66fb5e6fa26798133dce0bb7ce6e606872bc253adc5762edc02a4af99618e8d58573e67d5c67dcf1a47ccfa49c79a9fe87e33321d272131e6af2699c24a13f4cae340ff2b3bf34baf896f2fdc63ea6f42c245bb98db70a85a9c5233c0e18105f9b9fdb466f43bf6e59c2e561f385a2c2016627117bf0da79ec043be5221e86f6beaac596810cc4dff0670a14761592be5a1e5f1f10e6f4081470a4b6ef2851725296603b54eb9337709df096fe1df80be88497188d9996aaed8fea8f365d618f46ba01ef41daa96d06ae0ab4c88e9b39f76c638070fb8afcd3eeeba3b4aba10f0bfa19c1e67893bfb5ea9a85c732f49101e28ff3d653d7cda1da2024acac446aba63a135185c413d4831253cbc661ba8c402227e1178e3bf26886b1c303b9271301f569b4d93f9664b5818b492a648d953c556642d99ec5e39c203cf3f2fc7a48326de17c28ac9cc6c9d1cd295a47780bf66ca3a727e530581d8a2b525df16f9ae370c9c8b86e107380c4d011a64d882d58a11e0b9eed3bdba871470f28a5a76337d7ec65c8398998454ffb951b1c229ea6e2ad15e722f3fd1a5743922cc1599328f879245c0b270a1b782e0b54d685af1af21c2926351c08dd6c547857d698b5d94c97e9d179aaf0f1127a6d7bdde25060ea4b5c74d43e9ef14afaf4679cb55f94bbffae742e18efffe5b8ab5c3c43fff8976d2046902d679aea46a2212b3a0f9e36d07631246773b54d13459d19c3ad9fb208df2133c2579b74e79191943c15cea0bf6ffd7c56abac27291e8a68da1607446c00dbb20195c0514483a19653e82e9214455510b9d264fd1def53f5df96ea425c317e3de38f01c5c589243d2ee8c0dc66ca21a9180d38d906123863799b5d361e8e3ee64b13172f5d319f33a6e06bbf77e4886d0882a8a3ba0fa9c88d259669f41486fa2039bfde1146a810e605dea50ee90932d27c6c4a33a67d9b031cd8e49155940465c45c4e39108d59d03fadce5811651d1ab837338b8cd284f6af184b6456f779186b33b0649b55eb48ccfdba525b29c1d4440f93925c4d9381564486ad0e1db4b060f94b54aa3173616d66fc4dbcda7a083647a35a2882a2e9c2580fbea90f9cd23f715e40791bb60d2e4ebda6268ab7042c3746c0707a4433b2db06a7cf28ad49959a676373d99a5899b7a363d38a16ad603e68adb7b2eba672102dd07a83d2ebd7746747e8b39aa186d0fe94e1f5921166a255918beadeca6e0be8be7d595c9b8094e99c0acc60777b90c6ebf7ced54a0194a37887962dc9e236d20251824e51a4a2e496ac0c2311c09278e51dc022c0e90a8c086c8d201bdd71824d35ce3a8bef06989c9198ec36e68ca1ad49c3a577e5882d60df5e168628e1ccd9f7ffa0f8c3297f42b3327ae82d8604b02d9080115dbb2f467fb87789efaeabcf397e1cbfef9c5325be1da626aa4fbdaa091944bfcbd92856a881b7237b60822574f1f682e5a29b1cb2fe1a58c20ff0f89022ba8cc451ecccbc56fe066e199a191afbc856f677323a280c2fa4c86edbb41cfd419c497b5212bfaf1d9a503125c4a964b77e484a850bcfe2edfa44a9e0a3029eea45a12488ace40176484038d9ddb514b8e9acda89e6221f26f4980eca58bbfab00748a8bd082772a6767ec0fdc7c6a9d06a0b52d8261a1eea15f7754a1758613c21b5a1c0d3eaa2ebbafb03efa9645aa3b2c2aecf152daabc09dbbad74d6edfe647c3c80daad5f51288931daa30ec300fb98f15e55f001304f7f2e858b162640722a066e48fec7bc09f7e967b193727b0b9d03ccc75ee8f9f7c6895bd95d96c50982b39d0f9a25a21c2fe8ee0133f0e7f081c1a1339e40251f6d14ab8938b910baeba192d28ef36f4c9710d7347ef093a25c075b58821a79fcb04286cf543dcd00d6589098e88bc8d86e84f1be9d2d1aea19694cffd4433118a004c7ee19e236cedc5eca5ad8e71ccb05353678ab39e712ab7ff6402c89a0ea597fede00686d18e521f39bfa606753d9d09fb69a80694445a1af0c31e1c1ca3f2e2223d152dd5730a9740090d905c45d262446c49b2a4d13961de9a8868543718af997d09ff66c0954173f5b000c742a14c47855a6ca7a67dbad651777356c8d195a08a2fec17b104e328d6df52ddce72dc4eaaa34b1b6acc585fd919b108d8032f77c98d95ae899c45d4539030faa7ceeeae2f26313f7409fc4d661928f91074fa03c2ad6e58564904a7bf297fa887ad79e24af932b8acfd8395ce15b691e215075bea0d8701b98e0efbb344099318f7aaff8a5735f9bbfa9b8aec8ac2ee238d6a6fa25021791797bbfeb777ffb578dea8372f2d395a65290600857aca8ca8fbf434cf8ad6d2b367ba3cc2059c6a17cbe3118f9fb31c30e5c532dc306900b1c47ab54d298c1058dc0f4c2cce1fe5b1b7054e7cd36095b9f7b2e7fcf73c6ff080607c848638570ee381fcacdaafccd84a964d74de557df19e4defd627b27000c39de1c344f57d1c31099b68c8a1daceb4e1622cf4bcf2b86632758a78be042d45c78dc420c71d36c4e8658e73387ca888422a0e0f37d0daa48937372e3bf198536c63750d24a5bbb09ad6fac56a4172425fad0285ae69e147a76a97b069cf17b62304f87149a4d2b36bcc9485d1b099db7cb8ef6c88829ebd5ad65aac4e01699243744d112c4f8c7f979b25123cdf1e1c7b6b93933811fad948ef8cf79d1f128d7a317fd84df43616bbe88f78ea0723b9d338b3c01e793ebab312cedc8f992a5a52b275bd6cc3e289866e2b6809417f46b639426a446639b2290f107fff2895c68ef3686f1a2f7208b21dc0d403f76525c6e917be6d5af28ee9c219268b8a26582886440bafe3c010c7fd85ec9ce00d0abef799c9d939c73731cca974e555cdb0e71e774aca3ffd4fa63b731ad4f3d69", 0x1000, 0x8}, {&(0x7f0000001280)="6989382fde6d76f955821bf33fd65f8761c187ef737e57e92d4aaf1bde1a4db236686ec5e6e2c331317f2e9ccfe9d5f6ec4707e49fa8e3831f3f4dda8438cb4713b0334d6458ea9c3c9433646850b022ee481ae768ba6e5d0483072aa8e50904988cd0db44e0b4d5408103e1901fb9e6b0f7108190ca024bc9c6fb53aa290eae1c9ac7a0e3", 0x85}, {&(0x7f0000001340)="63ac1d8074db67666d87f9880c559dd19bba728ce8e1472f8ee463cded9a6588973d35c0de5a0d077002567f73dfdbe2091b98f58881947988b60acf3696a9663ee9110b2bcbbabd7b59093561969a8260717d0d99543a43dfefd5eb487cffc2115ea3215d6736e8ab96aa70cd30f53f1e7d07437b037a322af8ac584370c1eaa1fddd47bd885305d9db3bfba3b95969d897b6786b40bfea6a9b7f64220b66e46b35ec10c2cf1ffb4f038fae7f47a1fee89e145c59149faf6f7febb7df971b90e6f50b379699081b80ec2373205e351357e55d5a", 0xd4, 0x1f}, {&(0x7f0000001440)="cabb57fcf241c40d45fb7c32e8f8d8fa3b522b3b76bece6027a18b872cbb7daefa168268457639e4d86410fdff6a4b798e3f519cecd608552140112a4d9d92ad43996fe35fb23a85629398525bd64594a4539fbc195de3556c53dd8141f47f5717f6d966e95ff96046098b072929456c6922e568267dfdb75cf8a88574ebafda8cbdf5592db0a6a50036f0c37406c957ab102666", 0x94, 0x101}, {&(0x7f0000001500)="1f06d9bd667c31c07528cf9ce088736a6effb4b2013dd176ac053559aae66e917ea07d2c1e9923d7d4b785ea191eb3399c501012850382ffd25f84de9ab649a4606bbcf12f15aa8c9de957bccbd15cbfbd54b082d592fe3f7a75c0cec8e788f7e578f53c5275eab76cbf1cf2712f0b2112003e43e69a7249a5772d7c0be25ef51a295829d82114116dab15680b40346bafdabcfcd49abb338d89e91826c9", 0x9e, 0x6}, {&(0x7f00000015c0)="a8a24c0fc4517008a9cb98aaa216b46d4255ec644ac7553ed779063017c79785e4bf76ff0edb65eee3a7838dbe46536aa10275987b9427e6edecb5ebecf6c73d859285a6f1d81ec3652f7efcf704785d58b0ccb99988ec2fc5d52642f363bd34a8649c17a19951f5ca403e1d93e6b59f7097c9b5fda96315693f7e39a4965e183f27e382d8d1f017254077c7df3617ae7f0ba1e46e0cbf2df90d8924e4cc10d59662252130c7bac7454df4152e9bb2314d93b2cf18edd1eff6c9091701c4726d7690dc8737fe14d4a1c2c3f288324fa52a0ca02fd8ffdbdcdbcb8a86340ca52752d05e5967474c785be6eea49a71fa27c0bf", 0xf2, 0x708b}, {&(0x7f00000016c0)="72d88dbb90c76a2323f233a7b58c5bbc0515c1498effa77a460dfdd3d19f8d3e6dd20b693496b17290c3d270c071df2b5219c3c15a7d4460367cf0761063013cb85dd6d3e679ae7d54f838e4ed5701647a3619da72698efc131930edb2cd11a93b9ee740b862073efc1b858120ab6bd697b75cf1c1c27f6c0eed2f760c34be75aadd8f055af6c21643b3ef1d9268c4", 0x8f, 0x2}], 0x200000, &(0x7f00000019c0)={[{@hide='hide'}], [{@hash='hash'}, {@uid_lt={'uid<', r1}}, {@euid_lt={'euid<', r3}}, {@uid_lt={'uid<', r5}}, {@pcr={'pcr', 0x3d, 0x2e}}]}) r6 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:54 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) fallocate(r2, 0x2, 0x0, 0x20) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000000)={0x4, 0x9, 0x7, 0x101}, 0x10) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2458.598639] audit: type=1804 audit(1588542954.665:1193): pid=15262 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.0" name="/root/syzkaller-testdir020875613/syzkaller.6l3sQO/3586/bus" dev="sda1" ino=16850 res=1 [ 2458.668831] sd 0:0:1:0: [sg0] tag#2967 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2458.677840] sd 0:0:1:0: [sg0] tag#2967 CDB: Read master cue [ 2458.683603] sd 0:0:1:0: [sg0] tag#2967 CDB[00]: 59 a5 95 88 96 9c 6e 71 2d 4a 14 29 bb be 90 5d [ 2458.692707] sd 0:0:1:0: [sg0] tag#2967 CDB[10]: cf f5 a9 62 6e d7 12 99 84 52 fb 2b a4 0c 9a 50 [ 2458.701663] sd 0:0:1:0: [sg0] tag#2967 CDB[20]: 85 19 cb 83 2b aa db b4 b9 7a 73 de be af 8d 82 21:55:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x108801, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000100)={@private=0xa010101, @empty}, 0x8) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x51, &(0x7f00000001c0)=""/81}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockname$l2tp6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x20) 21:55:55 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]}) r3 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8), 0x8) fcntl$setown(r3, 0x8, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x2, 0x1ff}, 0x0, 0xfffffffdffffffff, 0xffffffffffffffff, 0x8) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SIOCAX25NOUID(r5, 0x89e3, &(0x7f0000000500)=0x1) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x7400, &(0x7f0000000400)={&(0x7f0000000140)=ANY=[@ANYBLOB="68000000100005070000f9bbc7e4b627ef40354a", @ANYRES32=0x0, @ANYBLOB="251002fffff000103400120009000100766c616e000000002400020006000100040000000c00020000000000000800000c000200090000000a0000000a0005000f0000000000000008000a0059bc40db1e5c170aadf2955f8b445fdac67ff0050ef40ad47eb6df9eaa79c68876c931179fa69f42fe5a81585ffc8ad42f615d27c53e33bddd047549f4bfe78e38e98a2d990000000000001c9fe00d49f6d0d6b0fe1da8a0f82c6abf266404f6b8e71b88b6d2ae918cff5a92a40ddf7b2474ba51375a9a90d303ac1c01a9139f1258fe32db4027f027fd995a2dbb4e996aedffb3b1847f0b406a1fae482510a1a9062f30b3c767024e4f62ac0281a0eb76aa6f3333a9a4a19c99ee1415ebd1682f1faf3cfe6fce36a9e2b467324b17b4919bede0ce4e3a41f0cc1c59faf2a9f6663a27153d64326dc5cefb6c087858cb7a1ac79f2baa3e3ee41872c2b406c7703ff7848a17bafdf280b4083c24e8e413cbb312567980e25e1fdf84b5a08033c6829556b205f6bbacec81ccd8e06e7991a5ed0b50d39857c6aaf24bad51017a6c64dcb988192a34dc5b0b8b8e3d3445535085c8d273d088a298a4fe840ee8af4a47070d4f63a3c560143f8e359de5db9c004241373ae5dfd3d7c89e9391bb4c734a0dcb639544b6d2dcbb48d3012ab65bc171f3bc60965fee6ad4a0c4f95a35bd230a000000000000000000", @ANYRES32=0x0, @ANYBLOB="b1095fdfe8d99b634415afcd2d83413c506882037fb9f923c9327400baca9e5914fbbc591310a608c14c8df202ec112aae962f6bd0a3da8fd0c1b0ed2e4341c89947509d2e959e4c61b8928f08cc5a865f5d96fc9c433a3320dd08d1524c0e4ab489ef000000000000000000"], 0x68}}, 0x0) ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, &(0x7f0000000440)) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f00000000c0)) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vsock\x00', 0x2fa5a833c3ead286, 0x0) setsockopt$inet6_opts(r6, 0x29, 0x39, &(0x7f00000004c0)=@fragment={0x21, 0x0, 0x40, 0x1, 0x0, 0x1f, 0x66}, 0x8) r7 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bsg\x00', 0x48000, 0x0) ioctl$TUNSETVNETBE(r7, 0x400454de, &(0x7f00000003c0)=0x1) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 2458.835041] sd 0:0:1:0: [sg0] tag#2967 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2458.844013] sd 0:0:1:0: [sg0] tag#2967 CDB: Report luns [ 2458.849501] sd 0:0:1:0: [sg0] tag#2967 CDB[00]: a0 00 00 00 19 00 00 00 00 00 00 00 00 00 00 00 [ 2458.858457] sd 0:0:1:0: [sg0] tag#2967 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2458.867398] sd 0:0:1:0: [sg0] tag#2967 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21:55:55 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x0, 0x0) io_submit(r0, 0x3, &(0x7f0000000240)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000000)="b21402b2528df10d6c60a347023ed0bf15815abec45a72318f711456eb6af8511f2b85f13ad27932c20d3f", 0x2b, 0x0, 0x0, 0x1}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x5, r1, &(0x7f0000000040)="ea697e519f214239f27f50bcac620f1acd4a406aa7c86661f5843d82d4ca0e0c", 0x20, 0x1, 0x0, 0x2}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x5, 0x9, r2, &(0x7f0000000100)="950c77452bb3411af4fb0a292016e31d44554ca4ddf8a0a5baf1a42ac5bd8c8b66f675491f22e40656597bcab16f6893cf6f6f07d1bed34cb1d4cefdeff72d90024da98e978c450c5dff8d4b49e8c92c65443f67dcd785597b30e4fd1544661ef3", 0x61, 0x7, 0x0, 0x7, r3}]) 21:55:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000001c0)='/dev/sg#\x00', 0x0, 0x480802) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x84, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x1}}, 0xa0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000100)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x80082102, &(0x7f0000000180)=r3) 21:55:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 21:55:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xffffffffffffffff, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f00000000c0)="59a59588c65b", 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) write$binfmt_script(r1, &(0x7f00000000c0)={'#! ', './file0', [{}], 0xa, "1caf5b863c9501dad2cd443cd76eae2da451cc756c5d6addffd7687c53e8769a99802408470c8ef6"}, 0x34) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/full\x00', 0x4000, 0x0) getsockopt$inet6_buf(r2, 0x29, 0x6, &(0x7f0000000480)=""/214, &(0x7f0000000580)=0xd6) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100)='/dev/input/mice\x00', 0x0) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x6c, 0xd, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x50}, 0x40080) [ 2459.394384] sd 0:0:1:0: [sg0] tag#2967 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2459.403427] sd 0:0:1:0: [sg0] tag#2967 CDB: Read Block Limits [ 2459.409428] sd 0:0:1:0: [sg0] tag#2967 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2459.418379] sd 0:0:1:0: [sg0] tag#2967 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2459.427310] sd 0:0:1:0: [sg0] tag#2967 CDB[20]: 9c 09 3f f0 09 21:55:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$AUDIT_TTY_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x3f8, 0x10, 0x70bd2a, 0x25dfdbfe, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, 0x0) getdents64(r0, &(0x7f0000001400)=""/4074, 0xfea) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) 21:55:55 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:55 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x2020, 0x0) ioctl$SIOCGETLINKNAME(r1, 0x89e0, &(0x7f0000000000)={0x4, 0x3}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) [ 2459.573912] sd 0:0:1:0: [sg0] tag#2967 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2459.582727] sd 0:0:1:0: [sg0] tag#2967 CDB: Read Block Limits [ 2459.588973] sd 0:0:1:0: [sg0] tag#2967 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2459.597926] sd 0:0:1:0: [sg0] tag#2967 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2459.606935] sd 0:0:1:0: [sg0] tag#2967 CDB[20]: 9c 09 3f f0 09 [ 2459.750846] selinux_nlmsg_perm: 464 callbacks suppressed [ 2459.750858] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 21:55:56 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0xfedd, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x42c, 0x2, [@TCA_TCINDEX_POLICE={0x408, 0x6, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0x5, 0x8001, 0x40, 0x4, 0xfffffffb, 0x8, 0xffff, 0x80000000, 0x0, 0x400, 0x3f, 0x95, 0xebc, 0xfe, 0x1, 0xfff, 0xa49f, 0x3eb91401, 0x29e, 0x1, 0xffff6328, 0x75fd, 0x200, 0x800, 0x1, 0x7ff, 0x3a927c2e, 0x2, 0x3, 0x7, 0x3, 0xfffff268, 0x7fffffff, 0x1ff, 0x80, 0x18bd, 0x8, 0x1, 0x4a3a, 0x10000, 0x6, 0x80, 0x5, 0x2, 0x55, 0x9ee9, 0x4, 0x4, 0x8, 0x5, 0xfffffffe, 0x8, 0x0, 0x7, 0x6, 0x180, 0x7, 0xc90d, 0x8001, 0x4, 0x5, 0x6, 0x400, 0x0, 0xde8, 0x5, 0x8, 0x4, 0x0, 0x100, 0x8000, 0xac, 0x2, 0x5, 0x9, 0x4, 0xffff, 0x8, 0x9, 0x9, 0x7, 0x8, 0x3, 0x7fffffff, 0x8, 0xf8000000, 0xa5d9, 0x4, 0x7b1, 0x3, 0x10001, 0x8000000, 0xda2a, 0x4, 0x5972, 0x6add, 0xfea3, 0x0, 0x7fff, 0x7fffffff, 0x80000000, 0x3, 0xfff, 0x7fff, 0xac71, 0x16, 0x1a2, 0x4, 0x5, 0x6, 0x5, 0x4150, 0x8000, 0x0, 0x1000, 0x0, 0x7, 0xff, 0x239, 0x4, 0x0, 0x32, 0x3, 0x1, 0x3ff, 0x401, 0x9, 0x9, 0xffff, 0x401, 0x6, 0x4, 0x7, 0x7, 0x40, 0x3ff, 0x101, 0x7ff, 0x4, 0xddb9, 0x400, 0x7ff, 0x20000, 0x39, 0x2, 0x794, 0x1, 0x4, 0xfffffff8, 0x9, 0x8, 0x5, 0x1, 0x2, 0x4, 0x3, 0x200, 0x10000, 0x7, 0x0, 0x4, 0x0, 0x8, 0x7cb8, 0x8, 0x8, 0x2, 0x0, 0x1000, 0x200, 0x4, 0xff, 0x6, 0x0, 0x7fff, 0x64, 0x0, 0x1, 0x400, 0x9, 0xac, 0x7, 0x0, 0x1, 0x1, 0xffffff70, 0x401, 0x3ff, 0x80, 0x401, 0x3, 0x80000000, 0x1, 0x5, 0xc5a, 0x5, 0x3, 0x8859, 0x8, 0x2cb, 0x3, 0x80, 0x5, 0x4, 0xff, 0xd484, 0x81, 0xfff, 0x5, 0x4, 0x6, 0x1ff, 0x3, 0x3ff, 0x2, 0x3, 0x1, 0x2af, 0x4, 0x7, 0x4, 0xffff, 0x7fff, 0x6, 0x4, 0xffffffff, 0x4, 0x9, 0x3ff, 0x8, 0x2, 0x0, 0x80000000, 0x0, 0x7fd6, 0x7ff, 0x7, 0x1, 0x1, 0x7ff, 0x800, 0xfa, 0x5, 0x9, 0xce, 0x0, 0x154, 0x1, 0x1, 0x8, 0x3, 0x2, 0x4, 0x3f, 0x401]}]}, @TCA_TCINDEX_POLICE={0x18, 0x6, [@TCA_POLICE_RATE64={0xc}, @TCA_POLICE_RESULT={0x8, 0x5, 0x4}]}, @TCA_TCINDEX_MASK={0x6, 0x2, 0x8}]}}]}, 0x45c}}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@remote, @in6=@remote, 0x4e22, 0x0, 0x4e24, 0x1a, 0xa, 0x60, 0x1a0, 0x6c, r4, r6}, {0xfbb1, 0x840, 0x10001, 0x1, 0x7ff, 0xfffffffffffffff7, 0x6, 0x8}, {0x1, 0x5, 0x4c, 0x7}, 0x37b7ed20, 0x6e6bbe, 0x1, 0x1, 0x2, 0x1}, {{@in6=@private2={0xfc, 0x2, [], 0x1}, 0x4d3, 0x3c}, 0xa, @in6=@local, 0x3503, 0x1, 0x0, 0xf9, 0x9, 0x7, 0x2}}, 0xe8) r7 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2459.832074] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 [ 2459.873118] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 [ 2459.887111] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 [ 2459.901348] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 21:55:56 executing program 0: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @perf_config_ext, 0x200, 0x0, 0x0, 0x3, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, &(0x7f0000000200)=""/245) r1 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x8) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000300)=0x80000001fe, 0x4) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_dccp_buf(r3, 0x21, 0x80, &(0x7f0000000140)="549bd581692ae36404940d902fb430bfb20a87ac45a1936881a153e45be59e76045111763b4a8afe65a302395918656b3b70b67b54b5ad9817ec84", 0x3b) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, 0x0, 0x0) r4 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000580)="fd", 0x1, 0xfffffffffffffffb) keyctl$search(0xa, r4, &(0x7f0000000080)='logon\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_ENUMAUDIO(r5, 0xc0345641, &(0x7f0000000180)={0x2, "1415dc4f72aecaa74d0ed169c32efef6743210119a37b169f999186186fac7d8", 0x2}) keyctl$set_timeout(0xf, r4, 0x0) ftruncate(r2, 0x80006) [ 2459.953384] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 21:55:56 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SIOCRSACCEPT(r2, 0x89e3) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2460.044713] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 [ 2460.124090] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 [ 2460.152585] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 [ 2460.192290] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15354 comm=syz-executor.3 21:55:56 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x6ec044346e017608}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x1) r1 = open(&(0x7f0000000080)='./bus\x00', 0x430c2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ftruncate(r1, 0x200004) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={0xffffffffffffffff, 0xc0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x3, 0x3}, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x7, 0xe, 0x5279}, &(0x7f0000000600)=0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=0x5}}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000c00)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13bd2321afb56fa54f26fb0b71d0e6adfefcf1d8f7faf75e0f226bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ceb9fbfbf9b0a4def23d410f6296b32a834388107200759cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee207d2f73902fbcfcf49822775985bf31b715f5888b24efa000000000000000000000000000000000000000000009500020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f7da31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a736770a71ad901ace383e41d277b10392a912ffaf6f658f3f9cd16286744f839c3f128f8f92ef992239eafce5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73755539280b064bd8144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06dddeb61799257ab55ff413c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d462357b22515567230ad1e1f4933545fe2c741374211663f6b63b1dd044dd0a2768e825972ea3b77641467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cc1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e87cdefb40e56e9cfad973347d0de7ba4754ff231a1b933d8f931ba3552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2af79b8d4c2bf0f7a2cb032dad13007b82e6044f643fc8cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942e367f603e3856a346cf7f9fe0bc9f2a1a7506d35e5eb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814459f3cdaaf9900"/1155], &(0x7f0000000140)='GPL\x00'}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r3, 0xc0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x7, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x52, 0xea, &(0x7f0000000440)=""/234, 0x0, 0xf, [], 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0xa, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x0, 0xb, 0x1}, 0x10, r2, r3}, 0x78) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0)=r2, 0x4) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="08002bbd7000ffdbdf250500000008000700ffffffff08000c000300000114000620fe80000000000000000039700000f39a2b9a5be4740b00000000000077414acbe65f4b798f02a44c759c0d6aaae78f648fde71355c0dc5a49f0f605b350a53a0c1e94b36158bc33a76eb67b11a46f867416d5e9043b07066f05eab5351933bdced8376bdbb216d2de5a6bd450111e839adfc81ea95381250c1a240dee6c9bad846edbe076239ccf297f9cd5791562d0d790fe6bc6dfa1e78f8660c9a69"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) sendfile(r0, r4, 0x0, 0x80001d00c0d0) r6 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:56 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:56 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x4f42c0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x20000004003}) getsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x8) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="800000000000000000000000ffff"], 0x14}}, 0x0) r5 = syz_open_dev$vcsn(&(0x7f00000002c0)='/dev/vcs#\x00', 0x73, 0x8c040) ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000380)) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="0800b469", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000500)={r6, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xc}}}, 0x5, 0x10ac, 0x2, 0x101, 0x4}, &(0x7f0000000480)=0x98) sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0xf8, r4, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x10001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7f}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xb4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_NODE={0x38, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x28000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x30, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'gre0\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x40084}, 0x80) stat(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000400)) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0x1000000000002}]) 21:55:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000380)) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000000c0)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2460.720425] sd 0:0:1:0: [sg0] tag#2998 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2460.729331] sd 0:0:1:0: [sg0] tag#2998 CDB: Read Block Limits [ 2460.735269] sd 0:0:1:0: [sg0] tag#2998 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2460.744270] sd 0:0:1:0: [sg0] tag#2998 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2460.753249] sd 0:0:1:0: [sg0] tag#2998 CDB[20]: 9c 09 3f f0 09 21:55:57 executing program 2: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000002c0)={'veth0_to_team\x00', 0x1000}) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000300)={'veth0_to_bridge\x00', {0x2, 0x4e23, @local}}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SOUND_MIXER_INFO(r2, 0x805c4d65, &(0x7f00000000c0)) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0xd, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0xa7f}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x4000000) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="00032cbd7000fbdbdf2502000000080001000300000008000200060000001c0108801c00078008000600f900000054000780080005009ce7951908000500856f8165080006005b00000008000600a0000000080005003f6c6852080005001ed4602e08000500a5124e2208000600e000000008000500af11974808000600cb000000340007801c0007800800050057a4520d080006007f0000000800050073fa0f77040007802400078008000600dc0000000800060040000000080005009c9a9172080005001a46ee622c000780080005003e58a23b08000500f42337300800060052000000080006004a000000080005008411514c1400078008000500a863b06008004b0000000000"], 0x140}, 0x1, 0x0, 0x0, 0x4004804}, 0x20044000) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="50010000", @ANYRES16, @ANYBLOB="200028bd7000fcdbdf250100000024010c8024000b8008000900f8a8560c08000a001976000008000a00ed780000080009001366db150c000b80080009009af17a3324000b8008000a004fe6000008000900e5d9c31808000900872b521508000a008aaf00000c000b8008000900c039b61d04000b800c000b8008000900e782840f1c000b8008000a009070000008000a004e6a000008000900cf8161491c000b800800090028915d2c08000900b1ba554a08000900ad0df56e4c000b800800090024de747a080009004180ab229feab01527cb48fb15ad6f4208000a004c03000008000900b797391208000900a1d1d9200800090070d498770800090062808a630800090063f0650008000a006fd600002c000b8008000a006ba80000080009001f68dd7108000a00125d000008000a001fa10000080009002b28770a08000100010000000800010066f2b482be78387c4b7a261045851b47e5a79c01659d5ae6d8ed13374f839b8d842b7fe5f677f16cdae8a0915fc7cc17c49d22b3d3c7b8d874cae9a283c68d3ae121eab9f018b671b6fd6942fe435b66c530bb6dd8d102"], 0x150}, 0x1, 0x0, 0x0, 0x2004000}, 0x4) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60010000", @ANYRES16, @ANYBLOB="00022abd7000fcdbdf2502000000b8000c8034000b8008000900699c0e1908000900cf58dd1d08000a00a377000008000900a8b1e70a08000a006b30000008000900b423684024000b8008000a005116000008000900e388046508000900c85aa32108000a65463d00002c000b8008000900ae820c5908000900974d6f1508000a003b7d0000080009009cc6df3808000900782291530c000b8008000a00c5cd000024000b8008000a009d70000008000a00a1cf000008000900fe12196508000900fe63cc3f0800020001000000080002000300000008000200020000001400048005000300070000000500030001000000040004803400048005000300050000000500030000000000050003000500000005000300010000000500030000000000050003000600000008000100ffffffff24000480050003000500007744000300010000000500030007000000050003000700000004000480"], 0x160}, 0x1, 0x0, 0x0, 0x24000090}, 0x4000817) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800e3ff", @ANYRES16, @ANYBLOB="100027bd7000fddbdf2501000000240004800500030000000000050003000000000005000300020000000500030000000000"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x40) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x4}, {0x5}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x2}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000081}, 0x240088d0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x1a0, 0x0, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_MLSLVLLST={0xb8, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x129427d1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3a1e902b}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb9}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x695a6a0}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6cbf5c2a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1e908f7d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa1a5066}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x66}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4d}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x291d9adc}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12c633f0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7203bfd6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x16}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1b}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0x94, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3b3f1290}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x64a6a862}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7623d6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x33}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x204ddd7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7439ff83}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x49adb36b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x42}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xed}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xea}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x566241f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x76}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x10}, 0x40001) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd4, 0x0, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0xb8, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xc0ed290}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeb52}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x300d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x63bf06d8}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb8bc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3699100f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x14f9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7bd970f7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3622eb4c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd4ac}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x32f1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x50893a8d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6c15a99e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b0c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6709}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5dee26c0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x27aba73b}]}, {0x4}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x86c4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x766d08a1}]}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8080}, 0x801) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x60, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0xc000) [ 2460.776570] sd 0:0:1:0: [sg0] tag#2967 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2460.785344] sd 0:0:1:0: [sg0] tag#2967 CDB: Read Block Limits [ 2460.791433] sd 0:0:1:0: [sg0] tag#2967 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2460.800364] sd 0:0:1:0: [sg0] tag#2967 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2460.809416] sd 0:0:1:0: [sg0] tag#2967 CDB[20]: 9c 09 3f f0 09 21:55:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/ttyS3\x00', 0x6000, 0x0) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000700)=0xfffffffb) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) write$binfmt_elf32(r1, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0x3f, 0x4, 0x7, 0x7, 0x3, 0x3, 0x3, 0xf0000000, 0x391, 0x38, 0x294, 0x67d04206, 0xfa7, 0x20, 0x2, 0x9, 0x3, 0x800}, [{0x6, 0x2, 0x7, 0xbd, 0x5, 0x12f, 0xffff, 0x408000}], "51defd559bba38684557e2d2482200b036e87b0a6f158026199c441cb39187536ee04cdc3187b593e882429f3823b831eb510a4b450526d9c24a0028964b48fe897f3b5e54ccee659ee8e33b42296b68cb7b51737fb6d0cd70734173724bcf45aa2fde1344234af4275173f5d6df74505c438223175c1718e88a8ffc0e5f7f085ef62f6f5cc4c19328a9ba3f239b0349a4eac66aaab1b9846dcfe680987b8d61a92c03", [[], [], [], [], []]}, 0x5fb) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:57 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VFIO_GET_API_VERSION(r3, 0x3b64) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_rose_SIOCRSCLRRT(r2, 0x89e4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f00000000c0)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0xfffffffbffff6f42, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) getresgid(&(0x7f00000004c0), &(0x7f0000000500), &(0x7f0000000540)=0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) mount$fuse(0x0, &(0x7f0000000380)='./bus\x00', &(0x7f00000003c0)='fuse\x00', 0x10020, &(0x7f0000000580)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}], [{@appraise='appraise'}, {@appraise_type='appraise_type=imasig'}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/sg#\x00'}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@fowner_lt={'fowner<', r5}}]}}) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) vmsplice(r1, &(0x7f0000000340)=[{&(0x7f0000000180)="98acf27868c9c5aa877a2378685225f2d9b7f6137169cc66e30ead1c9688ff7468b6cbcf6f61cb09cb06d81ea0805f9687e733bf595436f9d77a66464c9ca247a589d8a64f2ecd476cb95bebf6c82d23826732c410a1514d4df4", 0x5a}, {&(0x7f0000000200)="3901c55b41bce89281e448f79ecd461e075508ef1c345b2bfa587ad29406f279e6d89ce41d8a86e70059c680d90f25248a1ead94d6af0b84f12930ea5d5ffa0d98f082f5d5c88952459163630397720efa20dec79474a72d93a019a5ecdfa668615cc19dfe9e066cb2e85dd05accfbb41e6b567ecc9df2f28b1720036313962d63c5a9ee6cf5c008a6fecc4a2540ba138a936afdc0b35c4ca6b53bae5de9b3f2d47e805b92a0c066289942424c6467143e26de5b167857fdb62377e0067a9827693762cc68834f945810031cbef0a6cf3483f27e6c7c9f33aed840b31b93f6515447839e2d5c14d98e71e7d4d91740cf", 0xf0}, {&(0x7f0000000300)="12f71eea8e93a7d2b101bba38104408b8101e76623885331bf468ab97f44297cabe1ab2765370ba1e969c7219cbf497c0f04ea", 0x33}], 0x3, 0x4) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x6, 0x0, @buffer={0x0, 0x99, &(0x7f00000000c0)=""/153}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0xfffffffffffffffc, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x1, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=""/59, 0x3b}]}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={r5, 0x8}, 0x8) 21:55:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x81, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:57 executing program 5: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x71b}}, 0xa0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={r0, r1, 0xd, 0x1, r2}, 0x14) io_setup(0x1, &(0x7f0000000300)=0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r3, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r4, &(0x7f0000000040), 0xff66}]) 21:55:57 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:55:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f00000000c0)) 21:55:57 executing program 0: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x1008, {0x0, 0x3}, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xb6) ioctl$SIOCX25SSUBSCRIP(r1, 0x89e1, &(0x7f0000000280)={'erspan0\x00', 0x6, 0x3}) write$P9_RSTATFS(r1, &(0x7f00000001c0)={0x43, 0x9, 0x2, {0x1, 0x42, 0x7, 0x5, 0x80000000, 0x8, 0x0, 0x2, 0x2}}, 0x43) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x5452, &(0x7f0000000000)) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$FBIOPAN_DISPLAY(r4, 0x4606, &(0x7f0000000040)={0x140, 0x30, 0x320, 0x300, 0x6, 0x7, 0x4, 0x0, {0xffff, 0xff}, {0x81, 0x6}, {0xffff7fff, 0xfffffffc}, {0x60000, 0xffc000}, 0x1, 0x40, 0x8, 0x2, 0x1, 0xaf74, 0x20, 0x5, 0x4, 0x9, 0x10001, 0x6, 0x24, 0x200}) sendmsg$inet(r0, &(0x7f0000000180)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10, 0x0}, 0x200008c1) 21:55:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x1f, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000180)="59a59588c65bc986fbfe7c410bd4911f4e9bfe002192a01cac5bccdbc6f74f", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000540)=@filter={'filter\x00', 0xe, 0x4, 0x280, 0x258, 0x98, 0x98, 0x0, 0x0, 0x310, 0x1e8, 0x1e8, 0x1e8, 0x310, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 'veth0_to_bond\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000280)={0x3}, 0x4) connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400)='batadv\x00') sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)={0x1c, r7, 0x711, 0x0, 0x0, {0x9}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="24100000", @ANYRES16=r7, @ANYBLOB="00032cbd7000ffdbdf250800000005002e000000000008003b0000000100"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4004015) r8 = fcntl$dupfd(r6, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) sendmmsg(r3, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RRENAMEAT(r2, &(0x7f00000001c0)={0x7, 0x4b, 0x2}, 0x7) openat$cgroup_ro(r1, &(0x7f00000000c0)='rdma.current\x00', 0x0, 0x0) 21:55:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x5, 0x2400) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xffffffffffffffff, 0x63, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000000100)="ae00000000000000000000000012000000359c1553ce7ae962655f402b7cc7b0c3de853045278c1f5b95e98c9cf836d5fcf9844974ffd4bfcfc1b158a06b2e669b7075f47fb41672264a1d156a5c5b869c9ad21c49cfa10e2cd411f6de533fbf8afd83", 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2461.606317] ip_tables: iptables: counters copy to user failed while replacing table 21:55:57 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r2, 0x29, 0x34, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x8000, {0xe8c37bcd836adae7, {}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x2}}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r1) ioctl$VIDIOC_G_PARM(r1, 0xc0cc5615, &(0x7f00000000c0)={0x1, @raw_data="7a8c8245486c877a215714c95beedb356167783a74769c0b7cca3fa8c36384444101d16950240cb7b865dc64a97f0d71fe5321c4b74ba9d10b38eb62c425a6d19b498d79cddc8255c16aa839b3ad9b02dca9dffa458afff7a4b9c59632e66ae85c9e34108683e633c58681f27dca08e5db92b99fc7df97953a50aef517b58f671307a10b49b25eee81af5e0643d868f6782d2d2a753180618a8b0d0e9265fefd3132db0a7278d55fa4d494859d8992a1abf2ae4635340dde622f46c6fdc0b1a1010d8ef9186211bd"}) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x802, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vsock\x00', 0x1a000, 0x0) write$P9_RWRITE(r3, &(0x7f0000000280)={0xb, 0x77, 0x1, 0x7378}, 0xb) 21:55:58 executing program 0: modify_ldt$write(0x1, &(0x7f0000000240)={0x9, 0x20001000, 0x2000, 0x1, 0x2, 0x1, 0x1, 0x1, 0x0, 0x1}, 0x10) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0xfffffde3, &(0x7f0000000180)={0x0, 0xfffffffffffffd24}}, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1b40dcffff40dc", 0xff0f}], 0xc102, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x7c, 0x3, 0x8, 0x301, 0x0, 0x0, {0x3, 0x0, 0x5}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x22f0}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x4c, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x800}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x3f}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xd1b}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xfff}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xfffffff9}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8864}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000044}, 0x84) 21:55:58 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) prctl$PR_GET_ENDIAN(0x13, &(0x7f00000000c0)) 21:55:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x3, 0x210e80) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000}}, 0xa0) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x8000) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x6, 0x3f, 0x3e0}}, 0x28) socket$netlink(0x10, 0x3, 0x5) 21:55:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x48180, 0x0) ioctl$PPPIOCDISCONN(r1, 0x7439) dup(r0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) prlimit64(0x0, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000000)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @bcast, @rose, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x48) listen(r3, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmmsg(r3, &(0x7f0000001c40)=[{{&(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @remote}, 0x4, 0x1, 0x3, 0x4}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000200)="1541f84a7be9a391bd949b243c1cda3b6a12e768e242209bb56a711966d337db932858f23cd290b61e158492296e03e2686c5aff88165f0eb45193d51cead8e52d2ed06bfec169ec8e3b21f1e771bc9f09c51a7e004b44cc6ca27b4f10c20e7a84705e", 0x63}, {&(0x7f0000000280)="dad3eadc4f16af1a76adf69ff56f6b0bc9a87ed38a7f9913fd4280a8c3e60d823ea62cc58e1ff589640a67fedb5d29dd50bab7b1cff720aa20f95e262a5f392cd8", 0x41}, {&(0x7f0000000300)="04a3540abbf8c6d5d0da30ead9f566fa1c64358674e140a36c77fd78ca5b086752d540710bbc56ae0bcb51f12e9aec91bdf07f068930ddebadffd8dc67d8d4d3cec5be9a981f1f1a1917c71b6db61974ebdff2e234d9037441493cf196c386", 0x5f}, {&(0x7f00000005c0)="5cd011d8f6ac43dbcdb0781eab5e0b945d685038340a74f0d7de1631c7c5269d57412ccbf5e18f5c07d4eb5d926d70919feee177d8ca4e35b3d08a0cb1fa3baa2146aabab27fc68c8281d2707a9d32961a7e4a35e0a98652bc6800e0dea0da75140113e5f0f83565f6e2d4c4ef9b1f410baa2977eb738c62afc67e12f356ddd0c0ab3bc0f1dc59ce2be5df24f4f51aae126e2abad69a9dbaca8a5a9e6ce4835384eebdad293b99ea218f01bcda2a7211acf0a33476d6326d054bdf97634696af3cbf145dce87686042d51b3ba47766662e24dd3f7323929a89a689067509e91d073a96bd7cfdeca19859dd2c17d9274beb853563", 0xf4}, {&(0x7f0000000480)="2b429e38fc48cd1f7a4ed2fc00d329ae1ba2aadabe771b5f9b82221ea87bf8d3f941d340d8e00df6b36bc1a6ba4f80ebdced476277984864d041cf56495ec984a747f26ec788269732088943ee85eac969e0a6645ad0cb1a0802845becb2fdfbaf30143e670b9ed94f7056e95c1d498cc873571d6a51f807adacef943b3de33508f5ac01ea4982c48d45ee1396d2ebfca3c2bd7bd0a6c973c7", 0x99}], 0x5, &(0x7f0000000f00)=ANY=[@ANYBLOB="88000000000000000101000080000000efd4559ae8ff96f7fd1abcf54662fe732d0bcb37dbc5f47add0bf0da8c8759e7422ae6413d37aecab321e3dfaaac7f40bd20b494ea9fe902e0cac46defcb398bdc1bd14d70eb435e3bd56d2a933e0098bce8db37187a54423d30bb2e3207e34c0b347998870438053219ad03a6ef2f12a06c4a2626e6fd0040000000000000001301000005000000a370e10e8f35474e2ff21776481bd1565743c7dde004ea9a748ec1d891401caf997bbd16174ecc77d498650000000000f8000000000000003a00000003000000cb1f59c0ae82fbaec1f882c658a77c101c68a3ccda22aa18c3e166e69ed3e4cf6978af5c3f65038de128d4fb69fc013977b977b38af5857eedf146e1d26bb1e236db7fee9336d35a1eb206dcf22220f2330f6da9f2859ec48dd900a1d33e4dfa54b0d2e2674c63e160e1deeac985d962a4d04d684299fbbdd8496cef1a9ca08112f7bcca9ffb822eca9f526d27ab0801222d9348d72e44221a54a17387204ba893b9efeb1cedc016ead62a890056d8a79af8e5ed76186a3f1388e6071a71db71948d93c7ed4df41105a125231bae0000000000000007dcb120475c4826dabe8402000400000000006000000000000000100100000000000092b7bb9edef3fdad462e64fefed4227b1d9f235e64a679dcf807bd46a019bf81996709ba6e6437b5314d5994201464cf712a4c5d1270a2117c0fae632e50363f3d129aebab32514dcb1679fb29210000b00000000000000017010000ff0f000070dd32d5e4c7b711a18baef243fb87159f23adf629ba8d2f5d8c4d215a1b0d422f54330aec42a922a41d4c9e97f14c585a09bea6c1ae95bcbf4b52fee2033c26677ec3816199bf3fb7cc16caecb7a305132c94ce8f42fae91f5746655e23ef3d9fb0d6d1a9f9077288a50c447f1301b478d2975f044eab0804d1c7581b73f12b1e0f811372c55c13a0ed09aa7217e384b8073b9d374905f81ab0eec63e000000"], 0x2d0}}, {{&(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @local}, 0x41, 0x0, 0x1, 0x3}}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000380)="5b324001faa89631d020cc1a53779ca7323b02c3ae02d96ada903cd8d7d5b22a7541e86de69bcb1db87da3bd2c28314e5c6efeb134e12ce0718b38409c4c2fa4121330c0f63d44241503ababfdee528ae48f1098b5ff369fe0c1a787b8f30f034b22b1df762548cc3acb7465677daf7acfbce61067f5b91cdcfb56da2d7c4fea2673d2a8185f205ae7c5cefea1c6b51107730b3c82d459895e88f2a8fbbff7b4913583a31ba4c19925741ed809fba16403add7d38a0ddfe5e338aba01a46956ac4873ecb5ae4ac10", 0xc8}, {&(0x7f0000001cc0)="311e1de361e4ccf77c8ba112a1ef0440052e8db1f7ed864ee560ebaad5f6074f40b54cb3f408c0ebe2eaa4cb679f2a0afbe2f7ba5b6b28e18a22b97500689b12a9d27c1d603612aa561ee845c3d10c45bd792a2cd3b93c63a651ce4174d72febb9a1e57c7721d96445c54f61d271eb7bc1a85a9900a4c3e6a66481f63662d5e6e83bdfbc04cb5fe8cda3c3465cf64da986a0830e2fd919258a4f29da9ecb5e85ec9a698b879680a5ecc473e3eb547a3dcc6c1c5b135dd90553ba114aabc1d25c033fbfd4b0a57a705270f56d6e1ed6d0787efab3d1a170ccfe845d52a0f29e5d296530d7089baa14b0ca2cb2eb75e5b8d730cf126acf9481546d441297decdda2667f18446ec0158266b3d2480ce616a25978d6b570f806b5e1c9959190e9ca60099422bb67736dcfef0c4a1ee6f9a2db05e9d3dfb7d3129cfc6a43b601999657501f8e5e6b7d7f8101e7c380db1673d1a446940409857bf94596ba07b3740210f9875902cfeb442183a90f5c7da265b02fb1ca72d8f6e05e150daca0c79d51c3625878b5981c3319b22a37d7766591750d1bfa817370b61e2763af4177dc367fcfe3d2b406bdcdcd38d2994b52f08375dc14d9400c87eee8c878f919b69f83869f59d6bb7825b8a3a35e6f2bc37fa13f9506e64e6c4d63b668fb51a8272ca81cd66d1849761b10982fdbafd33619926161d7434222a4d898bd513f8ecb6e94b2054df49e227b5a4e9492661ee9234a707a3b6dbabb9bfaa71868b970b459c600bec4d9e73ca1abded327523b7a20045a1bf90f7bcecfbd9f8a2b15ec7638d7337acff0240a95505b3dca58a1f98c53980bc9663aa6ef6a253f4cb8d34f552995b3727cb240d90d34a366c0c907f78464f9d4a6c7eb24c9aa303e466ecce2966114eaf10b0ee7a50f0851c41693783d0ff2ee0e3f681624d535597a3e5127903e9ccee20de29e16280cabbfdc623c280e1272a10e47dce822ea2ce9e6be51ac2d8433dc4b5d92dc4b4dbe9620287e5b9e1c48f9e0f7b6902eebb2b1d54921de24ed80c732f46aca4de29d51111cf1b50215175015eb0863b59acd859c891e785c080a8fbcaa3d0394effb9ff4d66f4b6b73cb0f2a7bb2c095ffa94d222c0ef37e6c77767812629111a67f3fab6e21615df069f1e40e39719424b85161556ff2aabd29698926701aca424559cd4ac1b64a306be6ad2d52aa972f7ef3c68ec72eca07140dc50abc71d0d90184b5b965f7830e8a27fdaa578eeefe38f861b2d2678df91c801e4b48f4b8a68a4d3d587fcdac4ae8caa8ee217491695c17c5b039df9d1f813c79ace7a736ccf8ea5554c509347530d2eb836e976bceb6b37340744d21856b7570e99c0e7bcbe97957891411cbdf4eb6b5324df0e158ea6f6dbd7a41cdf684fe820d2ac04249238a383aea96eb30e8124ab3ba78f1a181eec8fd437184e5e7cb56c3a8d5ac882408e88d1c945470d14a8c449925cc1dd905569459e5dab55a768750345663e46ec510a1cd3e888552b5e2b586190a0d082756c8163e47bb08a3680f1ed1917fd48b877af7c16472006b9c3dff08c82b81d4153bdf83bb98350a191877a13f39958decf9c947a8f574cec96105639a399282491f8f66b647d871649f5636621650646281b73c8376f8985eddf8e88ee3cc66b3662fa3386c4b1cd53e3e7ca26bc1fe015213c1eb5685cbd369171cd67385dc29ba8e5abcb6f1e313b490933ac29f8fcb6ac4d937063c3360a5b3363eaa1258464a2f8526b6c059b59ce74d09431d0102e5fa8a44ac04c466a83200059bc351eb6fdb1923aa22e604d8d9e285ad616e4105255183f796f61323bbcbbfc9720ab74a293a18985d2ca82f10d4637aa4093dc4eff7f213bf4b6e4de0634226a6341e327ff22c194c95ba5d8fc40ba76e2944588d18435f1b2e8e6072d46c5f057114a5f343c96ef1cd05c93193f8b3bb76ba84774b0786a75f75cbd91d90e876c7b9fbfd47b4107bfce12c02171a19693df06a70dd671039cc7f9e10fa5b1a67b1b9d28461e9ace081becee8c32ac43d99b1852c79e39452e83a27e8c5ac116f987cc880ddd8ff645ac69fdae7f5e8084b858fb2016946eeef9d7b437f9173baf1329dd252c253864a7ea99a7becc8f75fa0b607dbc01f717937d70188b6555ae2b13cb587a9c5e87e614e5f68dd0e7628b6b0691f8e547d1e79636035a13c60d4beb54256e6ff7d07dfaf322797a942d993db5bf509674f025ee62ff23d4dea01b6b816bdfe87124148991e32bc75b0ee7f08c95b33142b874964d681759d86371687da120e3b2a61e227361f6c9067edfe213a57c4aab98e019eeefda1c1c9020b047a5200620d2ebfba224d01ffbd9769773a75cd16d66eb267451c241230c0060698c8987fc3a1cb9e7fb26a3fa5ef3ca193f8d3ea087cbfadd7b0eebc9852c58108e81218ae6c00a1c9280f41af4c82361029d35dce2dbbcbf37511887a515b04f6785931b8438ef3a1a585f1d82d82f9ca55c9caebd5187782295fa93faab5d05940481b2c46b76653b3f478435c34d4fea0ee2f81cbd7886b35ec52daafe3350b15c6804790c31a06aaf830bc2c4f838e895d1322ddad92e570d1b9f18913c35082abd9b1049f463329355a4eece7b1325b5a035b78e97aa913ce8fd79c4e4a21fd05560a206023475c3ed6fbc73c4be96e1995213d959df2f5e8de9b2f28275b52e011c751bd1273426855caf6d6fb0c7c65bfad7b7c901d7473a823dbc9e979569f19ac80bc322b40b3923b7518832eec27a39e42024e62ec116fa0ba953ff56d57d5a71e45e141c0749a2342e74cdc107eb9782437e9cf6a00861959387f8dc43a5f4aaf59cde31d8e8ac66acbdbd25d88930e37e19fee0ccffda391f0175bb3f2ba4caa94013abced8d32e13fe25a3ce4ab03566e903c0fd55400b024b5b2d790427a586bb260511de49e502f9546746ca56fd50c1689981eb331feca21d640ecd35da187480ed239c909a24f2baf20921d52e8dba0dee97e903d0019ad38ec114271bcc748d3762244b88e4ca759b05182648393d058f8889fbbba7c8e92c05d86ad00ecc7c59aaf2ba83efa841c64ca2f142647dd14b090525781beeda90b0387f0e6148ac2d9ea248692d49334ac7acaa0f5f592c390ee39c9520cf2a52d2742057079485dcf7c794d9eebcf87ba081163b8bd24dee3923dac3e5751aedc728be827de6a26c159ce1d72d062f54adb10cdfd06aeda172fcf4acc7164947add5c34d9c65142483c65ece04394003fae0b36fc587bc2196985e0087248da6c558317040837b83b5174a092f634ef86255e7036246f3781e99835f965260dafb614e8eec8bdcc1f99f6d0b4e89477a01bd8b8761919616e8b6973bf72986be73bce640a5f3f54c361b1fc71e5185e270ba31e5935227ebfd90cf49bc357cd20309913379d9a7b513944bc0b3e0b07ffd380644aa3d2389744a0b4cbf24b06c84e7b23a36c8af65a0aef3f4f32e139030e5ef0ea60bdae9159b1b0d4ecf6804a0284fb01193ceef277ea01059de650bec2588fab1e7c4e36ae179875c6472267dbdf7310cb307747396d34733963de148c1ff754b7fbde9a798d99d75c49c9946487917a3f21ef8da96b44635f9040bc1e6b9e3718294d53b7dd2072104901680545197cdd9a3c36b39cc8c7554e594925cda74eedc791c8b16addd902740919e56ffdd9f4077cc60ca00301c537839632b45cca8eb6ba8c1d3d88d0dc44487a5a58735c8753c64efbce5aa3a1dcd550824f24d29a9b3f2a276272113797efee6985fb8a1ba5739ca4775d143119cc29c5906e2f4e27329a046b43863d145bf4c33131fb92b2b472504e42f3e7916b98e591640f543b7464ea47ff48fc7bcd5a55801bb8233433c0e6024ffd7c46b6d1cc77188ee17225778233947d8430b6be456f596c62d406ed62564692f9e2bbec96eff5baeddfe1179990eee360d26ee19c7cf61bef8ac5b8bef0206e6a90e6445f058d871cf2c2ddb772bd5155f4bd780e23ec178f75f8b9dd057c1c4198031979790dc6a1bc7dce746fdb2028f42acbc51de575a91498fb86deddae4c07cee43aa36cf478ce2eac85577c746669a250f2679e132bd0fee6f1fa2ddc74dc73e6758144cbc8497d3fd4dbc6ccec7c492ad3a9433d1a52c6809ec7f56856172e053ce9bc1fe943276d24ea60c24a4eb9724ebe8f36dd1a46cc80e5202c1aa4b467cd8ba75b04f4113febc40dc59c5388a767499bc34ea90ed626d6c9d4514a92d90d63d950da91f41ccddaae03553966e76aefaeb6195cc36ecc4e4ed2888c209a3ea9aa0d4eab6b4b8e271248ddf0aafa6", 0xc00}], 0x2}}], 0x2, 0xc0000) unshare(0x40000000) r4 = accept(r3, 0x0, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r5, 0x4, 0x2000) write$binfmt_elf64(r4, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x2a9}, [{0x60000000}], "", [[], []]}, 0x278) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/seq\x00', 0x0) dup3(r6, 0xffffffffffffffff, 0x0) 21:55:58 executing program 0: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000700)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465c4d4049fc564e0b9cc7553358380b3a1f59916ffc9bf0bdf81509f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6e69f403ff065fd3072aae80677eeba68562eaeae2bcd87cef9000000a39ca7ef365cc27dfeac7bb40e9048517354b0ca4f9c84b619e40af8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19e9b5381791cbf0ceb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc08c2daa235197f1496679a9813c1efa26001b3f486eb6954871b4344faae85c4d0b96778478ae5355e6f923b1105696904fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2f9, 0x304, &(0x7f0000000040)="b90103600000f000009e0ff008001fffffe100004000632177fbac141414e0000001be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000, 0x0, 0xfeb9, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7"}, 0x28) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000100)={0x8, 0x2, 0x4, 0x80000000, 0x5, {r2, r3/1000+10000}, {0x2, 0x8, 0xbd, 0x8, 0x79, 0x7, "26106d7d"}, 0x5, 0x4, @fd, 0xffff, 0x0, r0}) setsockopt$inet6_tcp_TLS_RX(r4, 0x6, 0x2, &(0x7f0000000280)=@ccm_128={{0x304}, "3679ca21584798a2", "8c58f0aeff5919046bd2fb06a3d7d953", "d68e392a", "635505ea30823f44"}, 0x28) [ 2462.336097] IPVS: ftp: loaded support on port[0] = 21 21:55:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x0, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f00000000c0)=0x1) 21:55:58 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x80, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:58 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@ipv4={[], [], @local}, 0x4d2, 0x33}, 0x0, @in6=@mcast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000000)={0x3, 0x2, 0x4, 0x2000000, 0x6, {0x0, 0xea60}, {0x1, 0xc, 0x80, 0x5, 0x6, 0x3, "e42da04d"}, 0x1, 0x4, @userptr=0x2, 0x1, 0x0, r5}) ioctl$SIOCAX25NOUID(r6, 0x89e3, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 21:55:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x80000001, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:59 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x20082, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffff}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000500)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3f, 0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000480)='./file0\x00', 0x1) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="dbf6134c2c988adde6d77403faa560ca536b5767cfd599906810af9c7686037b9ddb375518922e", @ANYRESHEX, @ANYRES64, @ANYBLOB="00000000000000000000dffe9a05db15566e192c70d561b47d5ed42a62c18ad71b680bfb571115c7ee5db8e5bdfd1ed322b19368ec12ff09e6f505438097d779d51593ee789dd3add5b38e777b8eded90e624c17bb59d0363f377ed47ebc0a81a3a6ff11b0bdd94e515fb6857ecee68c164d78b4579472f5a272e6a655b2d9a789da2924f9bbef3ee8a70a70e23e6bbf5075ee4c51d4ba12f0c69a573d538feebad9fc9d1b3b22e98900beadf44d9ff6e9f9af9f57c1b695736cbfe85c891fde84d6f5df5edf3727901a5ddb14a798bd08ccc47b3a925c69bc4c2bb04349cc9706902370fe72f37a1e86e857cbc32397330bc4357e", @ANYBLOB, @ANYBLOB="5626eaf450e4798088184a39e7762a90ccdccd4e856e06b2e4eb15e2fdc1f2632a3bdcfcb600d938c24c3ad735f355b5cef8ccf9af68826d3aba3e19e37bd1f8e08a567cfb1f5e71e00d40add97e754008c9f39b6140c8bb660d94742b7f26da076324846dadebff59d0902af9f52640e7e50e4bd5ee0b6e325f40d0b89ea0c2"]) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/233) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, 0x0) 21:55:59 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) shmget(0x2, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0x7}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2, 0x2, r1, &(0x7f00000001c0)="7ecdbff3e8678b94d3a033c570d72c571c2d058e788320f3a4affcb2c0f56aef324b72d0b0febf82d2a57ebb7f2ef1ea69a0b0801253fc47c9a8a41ad7891b151a0bcbcb79558f9bbf689a1a4a2c66ca253c60d2865ccf90deb927a4daa74774f4d107274644962f62815130a061fa5f7babcc1f6fd76cb9761a8299c5df88714f3cdea46e6af41112303e61a0a8d432768ffe32385500ec40c9610f527aff2f6f6695b0bb0edeeb78020f6fa596b6b6e428c80ec09907c323e83e0908d1a4899814796bd60d160f0b099aa621eadc6a721edeaa12195095b1c897838f48e431ee93b208", 0xe4, 0xbfab, 0x0, 0x2}]) 21:55:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r5, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) write$P9_RGETATTR(r1, &(0x7f0000000180)={0xa0, 0x19, 0x0, {0x80, {0x80}, 0x42, r3, r7, 0x22, 0x0, 0x0, 0x10000000000, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xae4, 0xfffffffffffffffd}}, 0xa0) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x1}) 21:55:59 executing program 1: ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f00000000c0)) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:55:59 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000040)={@none, 0x1, 0x0, 0x5, 0x5, 0x4d, "d71bb1a6a0469b35fcd66a159a98b706593a681be4df47363819a734511245a91d568be08d2987d1cf1cc2e5daf2defdbb2131cde550630cb0a41f2170ed8a2e4ac9532c058676b6f96b9a56ced4641a00261615ecb0860f3802ddfe08c4dd0ebbe9bc2975d6fbd4d5522cf89f9b86e910140bc0b5b343e3b319f4d22bebc425"}) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x17, 0x0, @scatter={0x4, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/69, 0x45}, {&(0x7f0000000400)=""/235, 0xeb}, {&(0x7f0000000500)=""/215, 0xd7}, {&(0x7f0000000600)=""/144, 0x90}]}, &(0x7f0000000340)="058334656099dfb380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000002c0)}) r3 = dup2(r2, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x80002, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000)='TIPC\x00') sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 21:55:59 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r3 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r2) add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000900)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228897501f93191b076ac446ff0022b8753a1fa74ff569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23", 0x395, r3) keyctl$describe(0x6, r3, &(0x7f0000000000)=""/188, 0xbc) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:55:59 executing program 2: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x0) setitimer(0x1, &(0x7f0000000000)={{}, {0x0, 0x2710}}, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) flock(0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x24040811) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xaf93010e, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010001fff0000268f1c87c3cd01000000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e0000000400028008000a0036459cdb26cd03ccb7e638a66c866a951362d3fa985503f8f45bfb4e9240b985dda11bde27881f17233d3ad01f2177b1a53e51397d581d1549a05c1955f5d2a27a54f154dfab0a4d6a66872083c18972c13e068508685eb082db85be8bcf0074dd91f31c0bc042060d00"/148, @ANYRES32, @ANYBLOB="534fce983e5c2d7673b4958005e750e907d4fdc7bf13d088ad203bd736a916945b0f66f933a31733392547e20febfc8d209cbf74cde243bf2406fae4ddbe02d390fffad64b012deb14b92f020709e51b3e84a45b53c64c5aa753b3531c693655564c9a8ddb7d983a19eb11f0803dced96346ee580ea4a890f90a69b44067df0949c216f3b291122bcd89a0777619426cacf7375a9e293541d7f70f4c738e9580acb79cc9465802b2a647ecf12edffdca4a00493580b7c2c846f1a8bd3609d25a90e6f566609a73002762a2293a435c82a31624f5ecd4951aa455faade3a054552be833f7e8d36990ce33215c37fb9a705dd25c047668a5c3722f4c5bc28c4ee8898d88e31249734df2ffb3a84b62cf45d556dddcd15a1f"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(0xffffffffffffffff, 0xc0045520, 0x0) r0 = socket(0x10, 0x80002, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x28000, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x1400c045) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) [ 2463.395694] device vxlan0 entered promiscuous mode 21:55:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:55:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x8, 0x6a4fc0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xfffffffffffffe00, 0x40a142) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x4030ae7b, &(0x7f00000001c0)={0x554}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x2, r2}) 21:55:59 executing program 0: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8}}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') creat(&(0x7f0000000080)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus/../file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000040)=@v2={0x2, @aes256, 0x0, [], "8c390dcae1acbda0f7598bd087e85991"}) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) read(r2, &(0x7f0000000180)=""/19, 0xfffffe47) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) [ 2463.626961] device vxlan0 entered promiscuous mode 21:55:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@private2, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000200)={@private1, 0x22, r1}) socketpair(0xf, 0x800, 0x40000, &(0x7f0000000240)={0xffffffffffffffff}) sendmsg$NLBL_UNLABEL_C_LIST(r2, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x0, 0x200, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x14001) 21:55:59 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f00000000c0)) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_inet_SIOCRTMSG(r8, 0x890d, &(0x7f00000001c0)={0x0, {0x2, 0x4e23, @loopback}, {0x2, 0x4e24, @loopback}, {0x2, 0x4e22, @rand_addr=0x64010102}, 0x325, 0x0, 0x0, 0x0, 0xcec3, &(0x7f0000000180)='lo\x00', 0xff, 0xfffffffffffffff7, 0x5}) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@val, @void, @eth={@multicast, @remote, @val={@void}, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr=0x64010101, @loopback}, {0x0, 0x0, 0x0, @dev}}}}}}, 0x32) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:56:00 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000000)=0x5, 0x4) 21:56:00 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x4, @buffer={0x0, 0x2b, &(0x7f00000000c0)=""/43}, &(0x7f0000001380)="1700006c0000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000100)={0xb, 0x1}) 21:56:00 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = socket(0x27, 0xa, 0x40000) sendmsg$NFT_MSG_GETTABLE(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x70, 0x1, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x70}, 0x1, 0x0, 0x0, 0x8000}, 0x80) 21:56:00 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0xcf, 0xffff, 0x453, "16d2e0e2c875594aa74c98d0f119aa3f3d048f1d8d608f5017bc3619c69e4cc0f5fb0cd82e3f7fab7830dd9b0554441713e57c2e2c75dcb08d668f2b9759070d4d8a960d8a23be1b6e3fb23e3162820f9d41a1a75ecbbbb78e8868ce9fc55d05abf4639bf5e856012042d377ddf7a2ed0603a38cc9b9d68e0fecce3e8f8d0c8c0d2af7b415c31138b24c61cf37ec38034b7cef6c22d9c386a1855c47fc8bcd492db940e9ceccb9859bb2575a2fe67a8ab562a3d6df8b090babacc7cf2c0d9260cb2c86945d460f30785bb5abb0e180"}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:56:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffc6d, 0x20000800, &(0x7f0000000240)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00000000c0)="0204", 0x2) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x40, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x60000}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1f}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000}, 0x4004080) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, r2, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private0={0xfc, 0x0, [], 0x1}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x11}, 0x4000000) setsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffccf, 0x1f4, 0x0, 0xffffffffffffff37) 21:56:00 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)=""/171, &(0x7f0000000180), &(0x7f00000001c0), 0x1000}) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0xbf, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:56:00 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$9p(r2, &(0x7f0000000000)="902e4faeb4f0e143cf1dde1d45d320fbda342c0bff84a5d5b1408b46ad34d3030846ff95f1d721b34300b75ee39422c77eeb5fbfce94f7ed4860531ff10a20a351e7aad5074b43004283014c28", 0x4d) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:56:00 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) prctl$PR_GET_FP_MODE(0x2e) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x2}]) 21:56:01 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x81, 0x0, 0x0, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000000)={{0x6, @rose, 0x3}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) listen(r0, 0x0) unshare(0x42000200) r1 = accept(r0, 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000000c0)={@mcast1, 0x0}, &(0x7f0000000100)=0x14) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000126bd7000fcdbdf2506000000080031000500000008000300", @ANYRES32=r3, @ANYBLOB="08003200090001000100"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x800) write$binfmt_elf64(r1, &(0x7f0000000680)=ANY=[], 0x3f00) syz_genetlink_get_family_id$ethtool(0x0) [ 2464.755419] selinux_nlmsg_perm: 398 callbacks suppressed [ 2464.755429] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 [ 2464.822047] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 [ 2464.871199] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 21:56:01 executing program 2: openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/seq\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/bluetooth/6lowpan_enable\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$rds(0x15, 0x5, 0x0) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed02000a0000000001004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00b10efd9a000001000000000001fffffff60000005f42485266535f4d", 0x48, 0x10000}], 0x3, 0x0) [ 2465.004237] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 21:56:01 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r4, 0x0, 0x0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) statx(r5, &(0x7f0000000600)='./bus\x00', 0x2000, 0x2, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='system.posix_acl_default\x00', &(0x7f0000000740)=ANY=[@ANYBLOB="02000000010003000000000002000000", @ANYRES32=0x0, @ANYBLOB="02000200", @ANYRES32=0x0, @ANYBLOB="02000400", @ANYRES32=0x0, @ANYBLOB="02000600", @ANYRES32=0x0, @ANYBLOB="02000200", @ANYRES32=0x0, @ANYBLOB="02000400", @ANYRES32=0x0, @ANYBLOB="02000100", @ANYRES32=0x0, @ANYBLOB="02000600", @ANYRES32=0x0, @ANYBLOB="040003000000000008000000", @ANYRES32=0x0, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB="08226116", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000500", @ANYRES32=0x0, @ANYBLOB="08000400", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=r4, @ANYBLOB="08000200", @ANYRES32=r6, @ANYBLOB="10000400000000002000020000000000"], 0xac, 0x5) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f00000001c0)={0x990000, 0x9, 0xf06, r7, 0x0, &(0x7f0000000180)={0x9909d1, 0x6, [], @value64=0xffffffffffff7fff}}) ioctl$DRM_IOCTL_NEW_CTX(r8, 0x40086425, &(0x7f0000000200)={0x0, 0x2}) socketpair(0x15, 0x2, 0x4, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCAX25ADDFWD(r9, 0x89ea, &(0x7f00000002c0)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x0, 0x8}, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, 0xa0) write$P9_RVERSION(r1, &(0x7f00000000c0)={0x15, 0x65, 0xffff, 0x7, 0x8, '9P2000.L'}, 0x15) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2465.132667] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 [ 2465.173507] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 21:56:01 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='net/ip6_flowlabel\x00') preadv(r1, &(0x7f00000017c0), 0x22a, 0xaecff7f) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000140)={0x2, 0x8, 0x4, 0x20000, 0x9, {0x0, 0xea60}, {0x4, 0x2, 0x3, 0xf2, 0x38, 0x7, "e0a9c57d"}, 0x401, 0x1, @planes=&(0x7f0000000080)={0x0, 0x8, @mem_offset=0xff, 0x4}, 0x1, 0x0, r0}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0), 0x4) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, 0x551}, 0x40) r3 = creat(&(0x7f0000000300)='./bus\x00', 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x1ff}, 0xc) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000000)) fcntl$setstatus(r3, 0x4, 0x6900) ftruncate(r3, 0x800) lseek(r3, 0x0, 0x2) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x180) sendfile(r3, r4, 0x0, 0x8001) epoll_wait(r4, 0x0, 0x0, 0xe65f) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x600380, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000240), &(0x7f0000000280)=0x4) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000100)={0x0, 0x1, 0xdf52, 0x728df551}) 21:56:01 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f00000000c0)={0x1, 0x0, "fdb312393019799da0542fb085d4f4da6c9b764f6bd832a497ddf4d9e1d0c225579f3b1c7af03e9c0c42d8d55880010c837a67e99e1e3e59c393e7172219407380c4b4919facf4b71b9b8bc9b396e5c251f4dde10df8f18a1dc0f80ebf716450417501777b02158ebe1060a9aefcaa29c9f86f086a71e4690f5a1cec0b055380cb9f1fbb212ac63ee7626f476a742df2708caf5c1edf44a8984e0ff93a71a21bf3e5f37467701af3d3c9eaf2c68e47c08a5ba890c9d864ec21ac3d94bc37dc66f1451de13bcc1bc59ccb368c1bff03c5e188b4f9ea381ee67b4830e57eda45c4750e6a27db75f3b0d7bad899d2eafa4624aa0a1b861cd54ec13a48ababa1f616"}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2465.226196] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 21:56:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)={0x1c, 0x0, 0x711, 0x0, 0x0, {0x9}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000001e40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001e00)={&(0x7f0000000a40)={0x14, 0x0, 0x100, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) io_submit(0x0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0xff66}]) ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(0xffffffffffffffff, 0x80184153, &(0x7f00000002c0)={0x0, &(0x7f0000000280)=[&(0x7f0000000340)="c180ce83516cb22cc38948c63925fb64202ff5c62301450b91bd25b6a9c72a4b5b6d345e8a8fe39a71d1029f3f082cc5f5fc3ebe3ac125b27799b73cbed5db873265a8e1d3c5c0b9c2d9e28df33bcef9fb09dfe0e3985d71b7a5f6ebf376db49b34d48e0c9088f07e1a21eaa3ded656ab66d0d2f54ab80861d141cecee90a9f53bb1157a819816d31739b6b6835a12dcb54ddee7153a3303d8b1a8f83cc753c61859c4657fde1b4b6b406d6d40bdd6f35fd75664aa815bcb12b885106065201f524092c1d2f01791e1e1c4dc491f67a56e7a75b3ee7dd8a27e4f", &(0x7f00000001c0)="d6952d84deb18bb6af53a8bdb5c2e81ad33727583f1d81dac9c5970650b75c704f118b3fff152bf0812be1c4002ef72aad1b140c5575e243288e4928ec4bc6886d347440af1669626aba80928d37f53bbff1fdb9", &(0x7f00000004c0)="7709fba72527e17ba60b26c7465b00fc64942850a4483de22b21b761f1b862ae676a72bf80bae9d6882e5dabfb4a94b5a585884fc8f70a634c17607d7a8a3fd0bd74303b0cb387b6a217917f6b167517d3ffbcde2eafa9ab6517a87950202d058e4ffdd7f764eb9f53d8f101371c653b0ad39431934c9149d1ef8f7738596b0b36cefdfd0eb824f8fba19393af40581eb6a1db84200f17934ca8e51197965b3c00c3e5248126c3e82e6c8c1a733367cb8b1e93d74733a03c1c5d87856af407c72582fb6b2e5a9f"]}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000000)={0x0, 0x0, [], @bt={0x7fffffff, 0x10004, 0x3ff, 0x7ff, 0x5, 0x2cbc77dc, 0x1, 0x3}}) sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x201000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x10, 0x3f2, 0x400, 0x70bd25, 0x25dfdbfe, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x4048804}, 0x20008810) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) pivot_root(&(0x7f0000000700)='./bus\x00', &(0x7f0000000740)='./bus\x00') setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000006c0)=0x1, 0x4) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = socket$pptp(0x18, 0x1, 0x2) r5 = socket$inet6_dccp(0xa, 0x6, 0x0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) io_submit(0x0, 0x7, &(0x7f0000001d40)=[&(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x3, 0xffffffffffffffff, &(0x7f0000000780)="fa0c4a66fc5dd355d5b38e791287b40e3724", 0x12, 0x10001}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x5, 0x8, 0xffffffffffffffff, &(0x7f0000000800)="00271c425e122f06df58a133c78aa3e107448a486b99a1bdc45f556aadc7f5653e1e22c5841032f5016e15d75f2e4ad967ccf658a4e18ce9df1cc1ff13ada83cbdaeeccb631e6e59c897317801eecfae0d031bdc3dba804632dd6c8f3c490cfb67da761f168a23be886d3bfc9692b23665600c637e9ac03602f1ab0dd3f6efd4c9a6296d8bcb4fc7d4c5895c66f1", 0x8e, 0x9, 0x0, 0x0, r1}, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, &(0x7f0000000940)="ef9fd1efbc224a2aa3aeb3eb919a6ee6dd552ffd36c693d66ddd0ee86e970e44e092461ca57fc243b8d5a962a2848d89f1404e167f1c6b1508554c23b219f7499e90b054f5f52604580d83568d9b1217657a6535fdb006b5cdb8882d448b79596cbba414d3913b5e57421835c0cbb58ae4519ced9f5290ae80fc75347de992c027b0df866fefc7989b25e332870a35d555513fafdfbd6c6598afb0101504d3b136c08dd682d6c0be9eb83edb2598f7bf50e0f20a8f48dee04fe26bfa627d782833c89b4409c691e9ffe81402ec331a", 0xcf, 0x0, 0x0, 0x1}, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x8, 0xea2, 0xffffffffffffffff, &(0x7f0000000ac0)="8f08be8b941bf9a95962957ad2cecf6a43cb90747c3c66f540b8e734200c4ccfccc456c75cc97bbb5f90a5cbdf883b1b53fc69164218ff1ea938a682a907f868f8b59a2af2", 0x45, 0x4, 0x0, 0x2, r3}, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, 0x6b47, r4, &(0x7f0000000b80)="ef795321019844df5d2ea5c2a2bd228b297b3fda95304d5841ecc945b6aa89902fadaa908818b93fe4f579b5fd1414fa9ba32fe1dc669c9fdb8fe0686e3cd616ac9576055d3149ab977c9b22aa09264d3944071c5e43ed3532ed3558bf6fb7d05fd4a2daa98d2a04a595f234e3863a6bb987f6903ad760c485780e20bb60d4f9be1e0577de06b5ce345045ecb13cd85f675af953db1309ff3cd52997f12d2bf07d74fb365982be0fbbfcd1036651", 0xae, 0x0, 0x0, 0x1}, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x8, 0x0, r5, &(0x7f0000000c80)="4b9627beba58d3e2bd41ee1212f7abba9cb6cb9cca0d7f27e4c99f117c8d0f833bacf5b7456a", 0x26, 0x7e, 0x0, 0x2, r2}, &(0x7f0000001d00)={0x0, 0x0, 0x0, 0x3, 0x4a0, r1, &(0x7f0000000d00)="a8422c56da7af9c19824dae4454f8dd7365283f0b542f9e99eb225f7aaf6a3a0a3d424b033192e72e0a4428a70333587227a3730fec7ce8241f99963161f925e6553ff63e3e32e4ebdf7fba738c0afcdc3f0f62239d021414fec75ec2f628013261bedde101f797e474b2ffe339ad644f50aad44cfdefe586bc5abbb0f899363b018e1177e3cfb653e1bfff9c25827614653f728f7f613251da282c0dc60070d285eec4c0fc836d952ea4005b138859358230fb7125ab797d485637af818187dc59b84e102acb17c5d6929201a1c890a650717b09a51466e4bb37411a8c3d48f67ac52c8d0412c9a02ef00e17593969dd0920cbbe36fec22c6e8daaa8ff25bba2980ecd70460d4626f069e7d3d6b9e30c5f144db2b02667a7d7177f5a959d20b6e2b335a6f2582f8541fb907bb54e5eb9c5bffb0c3042353b8bb523204c3543620665a955fa48a713f6485c2df55f9288eb3ac4150ad29e5f846882a55e25038e67d2fdb18b2861f5663e7108f5f435c7ac3bbc96df187e7ba1e61dc94a9a033763eb545c16b00a9619112e50016a6f1a69d4e1405b495bad4f5eb5ece6433d1ee71579cbeea2bf6ac580e3b47d3f042e5882371c41ee8f13926e3ff24b7b063990df24307574669d4ace5cbd5f26bf390cf9ac0b72c43a2aa8859a7951553e38c2417d3ac6b55acbf926b8219ba010ba620a53854d7b64e9963b400bc46968ccbe2cacb89d1a1b31f11e393a58a0c3800f35703152aac6b8a2ec1f6502029e01fd7033c87e69f1c451a3c8574d03d9cab80a8c06af2602eed0b6423745c15478eda7f66bfb74e175fb211633fc7a8819c44f3902e715e3cd86f3cc08ebed2a26bbb0986bb496fc109d32bce79e2ba878a6a6de41d119c24d17c5a910632ffe7319e73efe39c63678bfda8d20fc931c2adae6fb40d8fee42a2faf4280593740c45a50132f7330252b1cf9c241f7d31f6c2e493916ddf2c7ae322443d9dc8e6175ed26733903e9c303d68251699fbfca56d4752c12206afb12e8068f45568561b0c71e619fdb29182bda9821b00bd769a36844c0ec9bf91734f415248e220c8296a926cb5008ab00838d969663941d9efb0da99dc2640687639828cdcabbe08d2d385d55ab0c6a709d4b44edb13da2a8ee736879e8ecd55ead0b92be5484960a449fd487802978d631dededdab60bfae5da9b9563d5abda14ff395ca0559b81d201891bf7f003d3cd4276ec792b2cee9794b097358822c3ed3380c9d4274ced29b3bdc4dd099f09f0438a8316e5ec1e9c42314e37f306ef1c23de2fac96640052280743ce5898012da727bdd47effbb03bff2e751df2118fb993afaf2066fb51774f2bfab43f3fe82deca32d49ce02561db1a9cd5251725574e9e45bac03a2e72e4228c132d23af11434065680bfb5afcb95a85eccd926d6577a9085080338f650b8e200bf8f4b63ecb5d7c9a1bd363adb28d0431d3e97be92f1cd88e1de9a573fda21ea1346ca93c221f4d61ce17b198a16e458d86f36851922e5ce4f066bdb7b3fe0a340ae379147d3c3b449f4a5507c5ee359d50b8e526c7d2eea9204d97c6c8a4671f34775ff925e3cd022b62d382c6598d30219c6f5efc036d3d99550c0d6f98ec1e1b283e08076f053ea564e898a95b7e2fd06acef7fba8adf773fb33ac76c2980eef421e4ece34426e743ee69d961b98723fb7d4d99ce3e74b9251a126bec978a39b4fe222cec40873d4c0f74081e1d6ddbde018cffe385b39079cc756ff4e098071887fb154f7715584f2fcdc2153d799a21b65520b37696bfb7f08a0a2ba8c7d20d0e51f3514cd27cdb22a514a9f1f8deb246f9960109a196302ebc28019c1946f6f1ab852553272891a8f13ba4f6441a7e41ed7bd8b14a2c92533bd0a8788433f177625fb14495ca16701f33b000dd4f39b56c856d0841e656873bf9a32a3362700c11e00303927ebfa3d48a161818d5f9ded987bb2bf79c03334a7089bb43df6c9a643134bde8017c3e4f444f6367beb70120fc233544e8705093196f2d480c65dcdebe4e98264036de10d480c266eb9c9561d882bd5970af511e726b11388761384174f895c137881e936d756fe01c55e3c15a398982fc0c2eaaafe46bee07cc7d05b5a814f412625380a884d86fc8660a4a28f83a407b9844425e465212f31a4480c7ac90be86ab782c792890c6c9e39cb7e592f06d49783ca9e430a4a6381e9a74d6392e437fa8863c6dc1deee6ac95c66857970ff3acb88c73354662916457f5611823f31f9e2421ec18907456d6ad7deecf0364ca8f30cd0c815b0b05c8a9d92225d36a9ff2c915264d9e64771fa3eaf13ad8bf5710916d3aeac003b5f909d910b8c9138e9072ccd5164e283a315f1b38716f2fcfe7d47a97f34f2b415e6585904bfe78f498dc0ccf20cb8f2439ac8495bed293a3b29b34a9b2af2b5ae519c37c00552e01fade78d741b3e23525e571811abcc7f669848f58cec374192904674484a9d63e94a95a93057c768e4b4bbecc040779c23c5ad2afcd205c753fa4af73d7d2f218469f22da417cd760e6067de5ef62149e390cde41910a2da7bb815b9a4362a3db958ec44c7f1ae7084399b9a586beccecd3c2df6214e59d606f2c461a60c8ec94e5a895aec70de005accaaa0199818eef9ea6c4c4a7a50d9426bbccb2029c2b327cba8217aba0e9f62a38433932c0edcea1dd8b963f0f32d4e6395c3c466d4a48719fa427894f01ab9918e0979bcc6cddb3c330d65d9e916851a784174dbbccd037e8c8b69700231edcb52edb60cf1cde5c0c9ca601c401b725facb84c6f8f97f9defe3d50b343c8bf7d3b23e2fc0ceee352e858073f5f1d9fecb2985ccf93ddeba4d79d44f053e608a3c132a77d9f85e449ddbf085dafc3cec1937a2b5876c7c2f1d681bbcf38e163e96c2379ead6afc0d5787498c54054e746b1dcd6f4c768c1f2342b5978f0cf205f897ff32db91649d7f38c2933efb64cf13f51327d5fff2120ccc67b09be224c013cfd69e04cfa61929ce7a13e93d12a9f5d624caa569f9a6216e564db311accef13a26e20970c2b64658c622f6046be0d285a6cc17f8e75604a368b32ef6de6aada2b4d45660f601fe13da6eebe065028f7af8ba8feb0b01d4b04866d1f46715cf95541bb1855c0104f44911a306ecc8b6d754afcb6e0fa77232ea45663b215b0feb065d854f0a100a2ace950ee93694d1e36a08424e5f6101039cce9b3022381a049bf4fbc924b335e46c237a469dc510cc5e28f0cd903a516cfbbc14fe36e971aef575492a1f1864c61acae74e742f0113c38cccaf64db862ec9fc6e8a2a34e5ed388a3643df11ae7b11790ca935f76d3c1ca8091a260df8123d3e09cd46af8de0fa1ba1973c4ce5bb9a880c1021c96f86a6a8901c15463b040ff6eb4a231826dac687de43a3058462ff617b5acd2e2a8b7d8886e406507a92d8e109fe47049a780b659903cca93567b84d518e650bb1c8027dc1ea459f96acdbe74ef08c2fad90137a497e89b1c69857ed74661a22e28298f146e40216841c9feafb9931240bf00a149c9910ec330872fa773b225bb84c3273a7cec1aab531b31d97b9834e75697f36751f012391d7603a600482c9bd315157c1cc000c7beb7c6c46992353f4ec2d2e45ce299dd7f86ec0becc2330b4f574ed6fc8c70ffc39d24e06734647e14042835bbbe4926107a2bfed4888f65e6ab932c714fe2d8a82cb17b86d33720a97b4f5a1675ec3e8e897173b46ba5fe6309581881ec759b400778e17224fb78ba72554138d296dce849064fc3abe8f36f44a13fe6a63c64839fa8f6d6e60c5c529be591aea8285883c2517dc6ecd5bfaad9fe1648c15d8769d17542f754f79da8766064d68036f6d10c0c424619a8206d25ab9e44224ab201de60aff21340c5d0864a261089a486f4a3f96ef667a03aab2bd210d84f014909bbca0f056a5d0fd6c2089d49ecfbfbe8fa09efefcbc12c96d230e218020d6d3d93e322fc71a515f114c02dc1dce0501c5fd20733262da2a489bf89c54759cd0c13dd5fbdf27331cba52f93d79d9d239cacfe0383d07182b4b4984d1ba1ce596fdd53def1080a2faf95fb5fbebc73312f6a6465d5533433e69c0a4c231a2af30e4a5ac16712f2b0edca6deaca8362b20cfca5fdc8c5251ca4f34f1037768b09c9781ffee276ea47c6e7e8056dd7c11425ab30738a365cd02e2d2c77340f77a97c67b2ee4231e5b3bf4c94078a0d9fa9410262464513ebf008130f72263ae3f737d07ac0f487ac05dcd5938fc8748a90e207e6164cc4f5f98da91eb87685914db472b4994366b147bb5175725d92d267b49e90d2f5661569800e9e274193d656c9977ee8f8b2c69a2dde86c8dab32e76f2ac7b29949eafcd3f70292e6de335222a0b0f8baa4576eca345d3792ac41a9a442bcb4101e3adf7f4e2efac7fe238e04ece8669abc8c7c81aa82bea3d3deadbdf637364271d93dd34b502082fcf8431f8f63ecdf81a8272f6c970572eccf7aa79fa463793aa2e42182ca15a774b73265f21ed1d223d433920cd38face709cab73e566f47771dcc0e36a04695540b06940e716b746c157065b6d7732fd204e0632fdeb6759e82058cd176525f3ffa8efa0b9f3e46b408ca6625d543844cd07cc404e103e6cdd8b0b5a7e057a35f4e90e308afecd0c49215885633abd509ede250005e07b7629265c21b967ce33ab1a4c3939d19827ecf3bdeff07374a7789aa762d5e9c4f290d323bfc96ccaeb15752045535c6d3ce5647053799649b8127a39d61369f5f34a7012088566abb82c1d24461e3ac0bb5ee384ca0d7029897bee21ea48be66357ce55eaa5b9a33ec4a9b187fb2966fd5cc2394f204e2d3e5002f9081cafd61f425bd36fca64345ae889a03ce474a043a16dbe9f747c078f8046f0fd34d2560eda3bff7fdc90a54ac9cd9fc78d7c467fc71918c66eeb9c315d881dfd3a54cfc0a8af54d9255b9aa5d18135c408dcf428a4ca91e132b022fa956b1a5dc56b7bca9905d3199a16d8bbedfd6d144503cf2b5471551f332737351f7191eb9610e88f359294f75b1ea7eccd8385a8cb2f432bd6bdcd5a8c5c0f1dbc3546b5eab7026ac03ecfbc0ef72a9af9b7fd277dd96de5caea6a0095359354f65b657382b79993232dee22972320ccf49502eac8aacbd5ca4823b738df7b43e9a83d1b2d6e12026c0c873836824b1cd5fc2b7b96931a728fc07132d311464f70ab18dc4faec2b0e859953051b2350c72a3259ab815697b77b02608cd02f7e09b912ee2f89985be7d80ec0ccd6e4406b30e4adde59b6d129a57bdaa019a347828768b96ffc3beb75905ed63168f6d992aa0a7ac6127345169cfdfc0712bcd87754b29d4696c552fca89eb13ac485796b1c8d00c7c963e9f9ecc98dfed2ac3c0c4b7b4ab6bb54a464921808bc079bc8c4026069f5d018554a5a5f84bcfcf4d79f0aee6b48782a5e2addb4a9ed0debb4f174b30525429feb6738ba4f492527b776b757b010981bf3abd7a9f11e0edd8f3a3873e6e226f875e2538b6455542f82abad7e60349d0622d67300b3e4eb4c2b6f58e6cd0b946f091d1a8ea86406dcdc3a5807258d932e3447fc2fc6dc89fc0f8a6c3af6e1116829006305ecdcab64eb633154086d158759d2379d1ae5e37be79a26dd58fc6a4a43aacb6cd8ce4cf07dbc5952def68ccfec4e1ef416264a4d9f822dafe87bf66c11a7a92540eb243cdbe9b23a9c45b384776ac3c3faa25a585b51015870e4909aff69c89285f90b3d7d7dda2c505dfd2", 0x1000, 0xfff, 0x0, 0x0, r6}]) [ 2465.283506] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 [ 2465.374295] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 21:56:01 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x118) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2465.477344] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15708 comm=syz-executor.3 21:56:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:01 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0xf9, 0xfd, 0xfa, 0x5, 0x0, 0x2, 0x40000, 0x6, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x7fff, 0x6, 0x6, 0x2, 0x2, 0x8}, r1, 0x1, r2, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:56:01 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000040)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0x0, r1, &(0x7f0000000040)}]) 21:56:02 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x4, [@int={0xc, 0x0, 0x0, 0x1, 0x0, 0x34, 0x0, 0x57, 0x2}]}, {0x0, [0x0, 0x5f]}}, &(0x7f0000000340)=""/129, 0x2c, 0x81}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={r1, 0x10, &(0x7f0000000400)={&(0x7f0000000100)=""/58, 0x3a, 0xffffffffffffffff}}, 0x10) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r4 = accept(r0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0xf0, 0x0, 0x0, 0x0, 0x0, {}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_IE={0xd1, 0x2a, "643900655fa8f53bdfd7941806a970c4906fac456fa898572b8b97b3f5e9b9ed5b8771c30f4ffd8ccca4cb8353f88c00bbed5a85e228ab2dd54ab93bde9bd2726d8f971fb9c9cede21331d5c4fa87e461a4ad5ef66871d719d0fca150fb26b69809c8d3ab34c7a56c3bd202ca3bc0cdc648eb18dce2800d2d9a50d75aebda387586a9ebfd5e253ad42dca4a15eba03a0862baf36161df291df7d3abd594e7e1c63858e29ca31603b023597b71edd0252984ca6e9158f0f9f90632045d2f2ae4fb36734131ed7113dc83490dba7"}]}, 0xf0}}, 0x0) recvmsg(r4, &(0x7f0000000040)={0x0, 0xfffffffffffffefb, &(0x7f000000b600)=[{&(0x7f0000002e80)=""/167, 0x2000a890}], 0x1}, 0x0) 21:56:02 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0x0, &(0x7f0000000180)}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x23, 0x400080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x0, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000380)=""/97, 0x24, 0x0, 0xffffffffffffffff, &(0x7f0000000300)}) ioctl$EXT4_IOC_MOVE_EXT(r6, 0xc028660f, &(0x7f0000000200)={0x0, r0, 0x7fffffff, 0x899c, 0x5, 0x2}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000180)={r7, 0x7}, &(0x7f00000001c0)=0x8) [ 2465.893634] audit: type=1804 audit(1588542962.156:1194): pid=15741 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir843763830/syzkaller.8Q0c8P/3393/bus" dev="sda1" ino=17426 res=1 21:56:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x20402) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$peek(0x6, r1, &(0x7f0000000080)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000200040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 2466.008635] audit: type=1804 audit(1588542962.156:1195): pid=15780 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir843763830/syzkaller.8Q0c8P/3393/bus" dev="sda1" ino=17426 res=1 21:56:02 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r1, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r5, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r6) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x0, 0xec, 0x5a, &(0x7f0000000340)="95f6d7e920a6b175159f80be13e713cb02154d192de386c0386652a57a523c12f1e4bf50d5d6bc8ce88ef417241fd57a17e771d8534add62a72e50f43cd866c55aefbe0164d0f70209a58f912bdf2ef74a10ba0440048d00ff5e8451df104c6e9a39a1fa325ece6a2236358dcfd75105b79a31be1502f154dea7b18fe7194a9bf4e691a9fc617ec8ae9de9e3b860365e7af215625d18d7438c4fac2907f65887ef358e8b8c8350c0c59f6e749712479febf61ddf4794e04a798121a2c8743a0fac7510d4a0e85f9fa86094e184e9f5937fba7faa29a9673d6fe90580530dbfc58c35905d04b8ba1f7253f99d", &(0x7f00000001c0)=""/90, 0x3, 0x0, 0xec, 0x9b, &(0x7f00000004c0)="56e4fcbb40550e8c186c16f198f21d1bc379561c2b13197e2d68bfc14c8dc4569d977c11bf5b0026ea9664f8dea3c84bc6cf44209f6af088d3c7eb07df097d51be669df5508f044e0b42142501625ed621315b490e729af1ccfc93cc64f40f9e219cc6681f597ccbe2f05c9efdc910c6843e7d3ad55766d1c7dcf67dd5b50cb373e6f19015a3362cbb8118ec5e40b55a3c76b44f62daa5d5c7b2d510f764adc9f40828aa07cbb60f1abea054f7a645016e24f9a84c050a6a9ac118e95743c937879dd06d087a8cb15e67998ae412d11df4a5a18e913e3bde8516a626a3d80fcb11117cbabddfdd5b30f80413", &(0x7f0000000640)="cb432b009f1342dd8b8f114a4e2b3194bae1a06b370b15da43927cee8c4566648051609626cefc2f40cc245040f8297ac8ecc700fc576d2633c3bb64f9d58122fe66450decf92f210345813987f28bad4fef1b2dafd5f4e9af97aa3155447534b9e97e168efe231d9cf45eb13e997c31de25cf8c05fa87fae3dd62f26bb6849bc014363b462733419097e505a9b82bac9686bda4cfe050a9a3e4b9"}, 0x40) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040), 0xff66}]) 21:56:02 executing program 2: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x1f, 0x5, 0x7, 0x9, 0x2, 0x3f, 0x25, 0x3, 0x9, 0x0, 0x3, 0x1, 0x81}, 0xe) io_setup(0x83, &(0x7f00000003c0)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r3, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = creat(&(0x7f0000000300)='./bus\x00', 0x0) ftruncate(r6, 0x8200) r7 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x800002, 0x11, r7, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000003280), 0x0) fcntl$setstatus(r0, 0x4, 0x44800) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2703000000000003, 0x0, 0x3, 0x1, 0x0, r0, &(0x7f0000000000), 0x8200}]) 21:56:02 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/xfrm_stat\x00') sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x10, 0x70bd2a, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6, 0x6, 0x4}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_MS_ADDRESS={0x8, 0x5, @loopback}, @GTPA_LINK={0x8, 0x1, r3}, @GTPA_LINK={0x8, 0x1, r7}, @GTPA_MS_ADDRESS={0x8, 0x5, @empty}, @GTPA_O_TEI={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_NET_NS_FD={0x8, 0x7, r8}]}, 0x68}, 0x1, 0x0, 0x0, 0x80}, 0x844) r9 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r9, r2, 0x0, 0x209) 21:56:02 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000700)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) ioctl$RTC_IRQP_SET(r2, 0x4008700c, 0x31c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x7ffffff7) 21:56:02 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xe) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="000600a1", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000200)={r3, 0x81}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000002c0)={0xfffa, 0x600, 0xfff, 0x9, r4}, &(0x7f0000000300)=0x10) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$UI_DEV_DESTROY(r2, 0x5502) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3c) ptrace$cont(0x18, r5, 0x0, 0x0) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r5, 0x0, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x32, 0x1, @tid=r5}, &(0x7f00000001c0)) 21:56:02 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0x15342abe8e25253b, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x10014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:56:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:03 executing program 0: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r1, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r5, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r6) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x0, 0xec, 0x5a, &(0x7f0000000340)="95f6d7e920a6b175159f80be13e713cb02154d192de386c0386652a57a523c12f1e4bf50d5d6bc8ce88ef417241fd57a17e771d8534add62a72e50f43cd866c55aefbe0164d0f70209a58f912bdf2ef74a10ba0440048d00ff5e8451df104c6e9a39a1fa325ece6a2236358dcfd75105b79a31be1502f154dea7b18fe7194a9bf4e691a9fc617ec8ae9de9e3b860365e7af215625d18d7438c4fac2907f65887ef358e8b8c8350c0c59f6e749712479febf61ddf4794e04a798121a2c8743a0fac7510d4a0e85f9fa86094e184e9f5937fba7faa29a9673d6fe90580530dbfc58c35905d04b8ba1f7253f99d", &(0x7f00000001c0)=""/90, 0x3, 0x0, 0xec, 0x9b, &(0x7f00000004c0)="56e4fcbb40550e8c186c16f198f21d1bc379561c2b13197e2d68bfc14c8dc4569d977c11bf5b0026ea9664f8dea3c84bc6cf44209f6af088d3c7eb07df097d51be669df5508f044e0b42142501625ed621315b490e729af1ccfc93cc64f40f9e219cc6681f597ccbe2f05c9efdc910c6843e7d3ad55766d1c7dcf67dd5b50cb373e6f19015a3362cbb8118ec5e40b55a3c76b44f62daa5d5c7b2d510f764adc9f40828aa07cbb60f1abea054f7a645016e24f9a84c050a6a9ac118e95743c937879dd06d087a8cb15e67998ae412d11df4a5a18e913e3bde8516a626a3d80fcb11117cbabddfdd5b30f80413", &(0x7f0000000640)="cb432b009f1342dd8b8f114a4e2b3194bae1a06b370b15da43927cee8c4566648051609626cefc2f40cc245040f8297ac8ecc700fc576d2633c3bb64f9d58122fe66450decf92f210345813987f28bad4fef1b2dafd5f4e9af97aa3155447534b9e97e168efe231d9cf45eb13e997c31de25cf8c05fa87fae3dd62f26bb6849bc014363b462733419097e505a9b82bac9686bda4cfe050a9a3e4b9"}, 0x40) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040), 0xff66}]) 21:56:03 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r4, 0x0, 0x0) fcntl$setownex(r3, 0xf, &(0x7f0000000040)={0x1, r4}) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0xbe, @dev={0xfe, 0x80, [], 0x16}, 0x40}, @in={0x2, 0x4e20, @broadcast}], 0x2c) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r5 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) sendfile(r1, r5, 0x0, 0x100) 21:56:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f00000000c0)) [ 2466.874770] scsi_io_completion: 4 callbacks suppressed [ 2466.874807] sd 0:0:1:0: [sg0] tag#2998 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2466.889217] sd 0:0:1:0: [sg0] tag#2998 CDB: Read Block Limits [ 2466.895238] sd 0:0:1:0: [sg0] tag#2998 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2466.904145] sd 0:0:1:0: [sg0] tag#2998 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2466.913090] sd 0:0:1:0: [sg0] tag#2998 CDB[20]: 9c 09 3f f0 09 [ 2466.924423] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2466.933338] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2466.939344] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2466.948292] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2466.957268] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 [ 2467.013787] sd 0:0:1:0: [sg0] tag#2998 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2467.023005] sd 0:0:1:0: [sg0] tag#2998 CDB: Read Block Limits [ 2467.029029] sd 0:0:1:0: [sg0] tag#2998 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2467.037941] sd 0:0:1:0: [sg0] tag#2998 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2467.046863] sd 0:0:1:0: [sg0] tag#2998 CDB[20]: 9c 09 3f f0 09 21:56:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$snddsp(r1, &(0x7f00000002c0)="e20bf48527a4956dffbe59449d01a8309f6e1d776fee941320e578d3157df0ec81fbf4d6ecf55e787975c27daa4d77e488cb7b0ee3a299f12dfd658c5880e000a93b520e6bc12c34ef5dfec5c6cec336ecde9eb4cb6a", 0x56) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x800000000000, 0x9}}, 0xa0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000180)={0x3, 0x5, 0x4}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r2 = syz_open_dev$video(&(0x7f0000000200)='/dev/video#\x00', 0x10001, 0x20000) ioctl$VIDIOC_G_CTRL(r2, 0xc008561b, &(0x7f0000000280)={0x1000, 0x7ff}) readv(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/153, 0x99}, {&(0x7f0000000180)}], 0x2) 21:56:03 executing program 0: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r1, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r5, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r6) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x0, 0xec, 0x5a, &(0x7f0000000340)="95f6d7e920a6b175159f80be13e713cb02154d192de386c0386652a57a523c12f1e4bf50d5d6bc8ce88ef417241fd57a17e771d8534add62a72e50f43cd866c55aefbe0164d0f70209a58f912bdf2ef74a10ba0440048d00ff5e8451df104c6e9a39a1fa325ece6a2236358dcfd75105b79a31be1502f154dea7b18fe7194a9bf4e691a9fc617ec8ae9de9e3b860365e7af215625d18d7438c4fac2907f65887ef358e8b8c8350c0c59f6e749712479febf61ddf4794e04a798121a2c8743a0fac7510d4a0e85f9fa86094e184e9f5937fba7faa29a9673d6fe90580530dbfc58c35905d04b8ba1f7253f99d", &(0x7f00000001c0)=""/90, 0x3, 0x0, 0xec, 0x9b, &(0x7f00000004c0)="56e4fcbb40550e8c186c16f198f21d1bc379561c2b13197e2d68bfc14c8dc4569d977c11bf5b0026ea9664f8dea3c84bc6cf44209f6af088d3c7eb07df097d51be669df5508f044e0b42142501625ed621315b490e729af1ccfc93cc64f40f9e219cc6681f597ccbe2f05c9efdc910c6843e7d3ad55766d1c7dcf67dd5b50cb373e6f19015a3362cbb8118ec5e40b55a3c76b44f62daa5d5c7b2d510f764adc9f40828aa07cbb60f1abea054f7a645016e24f9a84c050a6a9ac118e95743c937879dd06d087a8cb15e67998ae412d11df4a5a18e913e3bde8516a626a3d80fcb11117cbabddfdd5b30f80413", &(0x7f0000000640)="cb432b009f1342dd8b8f114a4e2b3194bae1a06b370b15da43927cee8c4566648051609626cefc2f40cc245040f8297ac8ecc700fc576d2633c3bb64f9d58122fe66450decf92f210345813987f28bad4fef1b2dafd5f4e9af97aa3155447534b9e97e168efe231d9cf45eb13e997c31de25cf8c05fa87fae3dd62f26bb6849bc014363b462733419097e505a9b82bac9686bda4cfe050a9a3e4b9"}, 0x40) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040), 0xff66}]) 21:56:03 executing program 2: r0 = socket(0x1000000010, 0x80002, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xfffffffffffffe08, 0x19, 0x1, {0x1, {}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x4, 0x0, 0x24fc}}, 0xa0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000001600010000000000000000000a000000", @ANYRES32, @ANYRESOCT=r1], 0x2c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 21:56:03 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x10000, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x301342, 0x0) r2 = socket$isdn(0x22, 0x3, 0x10) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$RXRPC_SECURITY_KEYRING(r3, 0x110, 0x2, &(0x7f0000000680)='/dev/net/tun\x00', 0xd) sendto$isdn(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="0200c90008000800027b5b30d785998146451dc638384f38a5ef20fd9bfb2885da881108c9663655c7e9474c377517fddf77eaa78113f19172d2479f42c488b6a092ee890fb5401a864df6ed56fc9aa2e3f3eee4d609584919693d9ea405d24e3d7bf3d2c141b022052a2897a8ddfda3120b3ac355c96c66cfb588c85300e8e2f235db228bd05cf93f6dd01abdccf5db625e08f11c47e7e5072b538b2e04b7273103aae9f9a2dc73f63bc2c2f52ccf15047f5f56ddd6614fa761437cd07a1af6dfaed5967c8574c1cc8f0ba1f05324d5b7c48dd0828e2727114a9b5d1731577869d2fb85071694fabe3c8f8000cdfa9dc57c48f61c915ea46ca789d4aa3973885819612625d1b9"], 0x41, 0x20008000, &(0x7f0000000080)={0x22, 0x9, 0xc, 0x8, 0x4}, 0x6) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) accept4(0xffffffffffffffff, &(0x7f0000000340)=@x25, &(0x7f0000000040)=0x80, 0x400) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)={0x28, r5, 0x1, 0x0, 0x0, {0x6}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6}, @IPVS_SVC_ATTR_PORT={0x6}]}]}, 0x28}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000440)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0xbc, r5, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7fff}, @IPVS_CMD_ATTR_DAEMON={0x78, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xffff}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x24000804}, 0x1) ioctl$DRM_IOCTL_MODE_RMFB(0xffffffffffffffff, 0xc00464af, &(0x7f0000000640)=0x9) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet_opts(r6, 0x0, 0x4, &(0x7f0000000100)="c961b3d9b232efc95f24dfb3075d67996a13bafd6003e5fd1751780ec36bac192ac491ce3a6002ef1b38984514372353c3b173618c296d5cdd7e5f59b26973bd53037171960c886731114dcf9b21ec948c005085d03a1160810e97afb2480bf5ee9e2e8242fe2c1b62e88d1cb6d5", 0x6e) [ 2467.383539] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. 21:56:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x7a, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000010000108000000000000000096000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x34}}, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r1, 0xc2604111, &(0x7f0000000180)={0x3, [[0xffffffff, 0xd80, 0x8, 0x5, 0x23b3, 0x4, 0x3c, 0x6], [0x101, 0xe1, 0x6, 0x6, 0x8e, 0xfffffffc, 0x7, 0x3], [0x10001, 0x9, 0x3, 0x4, 0x7, 0x9, 0xffffffff, 0xfffffffe]], [], [{0x9, 0x401, 0x1, 0x1, 0x0, 0x1}, {0x7a, 0x4, 0x1, 0x1, 0x1}, {0x2006, 0xf609}, {0x3, 0x39ee, 0x0, 0x1, 0x1}, {0xffffff98, 0x7, 0x0, 0x0, 0x1, 0x1}, {0xc6f1, 0x7, 0x0, 0x0, 0x1, 0x1}, {0x80, 0x2400, 0x0, 0x0, 0x1}, {0x3, 0x6}, {0xd21d, 0x8001, 0x1, 0x1, 0x1}, {0x2, 0x80000000, 0x1, 0x1, 0x0, 0x1}, {0x80000000, 0x4a, 0x0, 0x1}, {0x4, 0x10001, 0x0, 0x1, 0x0, 0x1}], [], 0x5}) syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00') sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = getpid() sched_setattr(r3, &(0x7f0000000040)={0x38, 0x2}, 0x0) r4 = getpid() prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000000)) sched_setattr(r4, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00') preadv(r5, &(0x7f00000017c0), 0x3da, 0x0) getpid() preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) 21:56:03 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400, 0x0) ioctl$VFIO_CHECK_EXTENSION(r0, 0x3b65, 0x4) io_setup(0x1, &(0x7f0000000300)=0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r1, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000040)=0xc) setuid(r3) setfsuid(r3) [ 2467.642820] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 21:56:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2467.686387] QAT: Invalid ioctl 21:56:03 executing program 0: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r1, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r5, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r6) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x0, 0xec, 0x5a, &(0x7f0000000340)="95f6d7e920a6b175159f80be13e713cb02154d192de386c0386652a57a523c12f1e4bf50d5d6bc8ce88ef417241fd57a17e771d8534add62a72e50f43cd866c55aefbe0164d0f70209a58f912bdf2ef74a10ba0440048d00ff5e8451df104c6e9a39a1fa325ece6a2236358dcfd75105b79a31be1502f154dea7b18fe7194a9bf4e691a9fc617ec8ae9de9e3b860365e7af215625d18d7438c4fac2907f65887ef358e8b8c8350c0c59f6e749712479febf61ddf4794e04a798121a2c8743a0fac7510d4a0e85f9fa86094e184e9f5937fba7faa29a9673d6fe90580530dbfc58c35905d04b8ba1f7253f99d", &(0x7f00000001c0)=""/90, 0x3, 0x0, 0xec, 0x9b, &(0x7f00000004c0)="56e4fcbb40550e8c186c16f198f21d1bc379561c2b13197e2d68bfc14c8dc4569d977c11bf5b0026ea9664f8dea3c84bc6cf44209f6af088d3c7eb07df097d51be669df5508f044e0b42142501625ed621315b490e729af1ccfc93cc64f40f9e219cc6681f597ccbe2f05c9efdc910c6843e7d3ad55766d1c7dcf67dd5b50cb373e6f19015a3362cbb8118ec5e40b55a3c76b44f62daa5d5c7b2d510f764adc9f40828aa07cbb60f1abea054f7a645016e24f9a84c050a6a9ac118e95743c937879dd06d087a8cb15e67998ae412d11df4a5a18e913e3bde8516a626a3d80fcb11117cbabddfdd5b30f80413", &(0x7f0000000640)="cb432b009f1342dd8b8f114a4e2b3194bae1a06b370b15da43927cee8c4566648051609626cefc2f40cc245040f8297ac8ecc700fc576d2633c3bb64f9d58122fe66450decf92f210345813987f28bad4fef1b2dafd5f4e9af97aa3155447534b9e97e168efe231d9cf45eb13e997c31de25cf8c05fa87fae3dd62f26bb6849bc014363b462733419097e505a9b82bac9686bda4cfe050a9a3e4b9"}, 0x40) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040), 0xff66}]) [ 2467.710647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2467.742784] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 2467.952050] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 2467.986339] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2468.015264] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 21:56:04 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x3, r2}) ioctl$TUNGETFILTER(r0, 0x801054db, 0x0) [ 2468.086198] QAT: Invalid ioctl 21:56:04 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f00000000c0)=0x3, &(0x7f0000000100)=0x2) 21:56:04 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000000)) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:04 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r5) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x0, 0xec, 0x5a, &(0x7f0000000340)="95f6d7e920a6b175159f80be13e713cb02154d192de386c0386652a57a523c12f1e4bf50d5d6bc8ce88ef417241fd57a17e771d8534add62a72e50f43cd866c55aefbe0164d0f70209a58f912bdf2ef74a10ba0440048d00ff5e8451df104c6e9a39a1fa325ece6a2236358dcfd75105b79a31be1502f154dea7b18fe7194a9bf4e691a9fc617ec8ae9de9e3b860365e7af215625d18d7438c4fac2907f65887ef358e8b8c8350c0c59f6e749712479febf61ddf4794e04a798121a2c8743a0fac7510d4a0e85f9fa86094e184e9f5937fba7faa29a9673d6fe90580530dbfc58c35905d04b8ba1f7253f99d", &(0x7f00000001c0)=""/90, 0x3, 0x0, 0xec, 0x9b, &(0x7f00000004c0)="56e4fcbb40550e8c186c16f198f21d1bc379561c2b13197e2d68bfc14c8dc4569d977c11bf5b0026ea9664f8dea3c84bc6cf44209f6af088d3c7eb07df097d51be669df5508f044e0b42142501625ed621315b490e729af1ccfc93cc64f40f9e219cc6681f597ccbe2f05c9efdc910c6843e7d3ad55766d1c7dcf67dd5b50cb373e6f19015a3362cbb8118ec5e40b55a3c76b44f62daa5d5c7b2d510f764adc9f40828aa07cbb60f1abea054f7a645016e24f9a84c050a6a9ac118e95743c937879dd06d087a8cb15e67998ae412d11df4a5a18e913e3bde8516a626a3d80fcb11117cbabddfdd5b30f80413", &(0x7f0000000640)="cb432b009f1342dd8b8f114a4e2b3194bae1a06b370b15da43927cee8c4566648051609626cefc2f40cc245040f8297ac8ecc700fc576d2633c3bb64f9d58122fe66450decf92f210345813987f28bad4fef1b2dafd5f4e9af97aa3155447534b9e97e168efe231d9cf45eb13e997c31de25cf8c05fa87fae3dd62f26bb6849bc014363b462733419097e505a9b82bac9686bda4cfe050a9a3e4b9"}, 0x40) 21:56:04 executing program 2: r0 = socket$kcm(0x10, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e0a10000000e8bd6efb250009000e000100410000ff050005001201", 0x2e}], 0x1}, 0x0) 21:56:04 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @multicast2}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240), 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x840}, 0x40) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x1039c) sendto$inet(r0, 0x0, 0xffffffffffffff12, 0x20000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) r1 = socket(0x0, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) socket(0x0, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2400000024000b0f00"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000001608a791eea795b919ceb74853cdbb06fe5ea1f935a2ca177e83ef3e3470074d67acce7395aa6884877a45d52299339ef743032be836d9521496ec602a783dc96d2ede830499864c9ecf5212730c774b487b36aa857be2a3cf6c793ced5bdb9fc5040d601bb639aeb4a36f71ffb4a0cda8157ab17d6ee82a50e158382c4f3a9d231621227810c238a198cebfcc5f7276f004f694f69a960d537b803fc48c8c5db2e6721066167877"], 0x24}}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x2c000004) sendto$inet(r0, &(0x7f0000000140)="7c0d111317b1ff8ec8f29f81319ec5b10d0d003f00efd9448dbef1ffb4e3a6af87131512da528f6235fe35d3053b5cb4877c1b89bbf83f6d749d5b00679601a3abdc204cf1ad797252bb0c7b43e3e9763221cb2c8d76f824f4bea338f53aa75703f465e50e434e2193900c39ab79d37cc0ce7a", 0xffffffffffffffd0, 0x401c005, 0x0, 0xffffffffffffff36) socket(0x0, 0x80000, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 21:56:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:05 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r5) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) 21:56:05 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) mount$9p_virtio(&(0x7f0000000040)='syz\x00', &(0x7f0000000080)='./bus\x00', &(0x7f00000001c0)='9p\x00', 0x189802, &(0x7f00000003c0)={'trans=virtio,', {[{@dfltgid={'dfltgid', 0x3d, r5}}, {@access_client='access=client'}], [{@subj_role={'subj_role', 0x3d, '#'}}, {@permit_directio='permit_directio'}, {@audit='audit'}, {@fowner_lt={'fowner<', r4}}, {@fsmagic={'fsmagic', 0x3d, 0x100000000}}]}}) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000000)=@req3={0x7c0, 0x401, 0x7, 0x3, 0x1000, 0x82b2, 0x6}, 0x1c) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:05 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r2, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NL80211_CMD_GET_KEY(r4, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000480)={0xc0, r3, 0x400, 0x0, 0x0, {}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "2a5a259438"}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY={0x74, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "677c727e19feea646fbfab3345"}, @NL80211_KEY_DEFAULT_TYPES={0x10, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_IDX={0x5, 0x2, 0x3}, @NL80211_KEY_SEQ={0x10, 0x4, "a7570eabb5cd329a7c033e17"}, @NL80211_KEY_MODE={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "4dbb89f786"}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "c324414acdb7cc81e7d990c9a3"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, @NL80211_ATTR_KEY_SEQ={0x13, 0xa, "66de8f2a1e748635470a6fc4f6241a"}]}, 0xc0}}, 0x20040050) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r3, @ANYBLOB="000126bd7000fbdbdf25440000001c00238006001900ffff000006000d002c000000080015004b0000001c0070000500020001000000040007000400070005000100010000007000700004000000000057000300000000007ec259bac785f58507f85eb28aaf7468c2ed89ed830245463d70a6d20d27e468b45b8ec7d048ee8b15dab8427679c16e084befc24a35c69d169927534c5fa66a0021002400681c859b51cfc73761e043c63ff43fc21f53a9811681c77ec3a1f3f8eb00000008000c00008000000400080100"/215], 0xec}, 0x1, 0x0, 0x0, 0x48800}, 0x615a7fdab14faa53) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/autofs\x00', 0x40000, 0x0) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000300)='NET_DM\x00') r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$netrom_NETROM_T1(r7, 0x103, 0x1, &(0x7f0000000440)=0xffff, 0x4) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r6, 0x4, 0x70bd2d, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TIOCL_PASTESEL(r8, 0x541c, &(0x7f0000000400)) 21:56:05 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) membarrier(0x20, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000640)={{0x2, 0x0, 0x80, {0x3000, 0xd000, 0x1}}, "22d1729bc099ce05230045155ec503c717f497add3a5ba0d5338f1af6717aaf1ea32fc1de45eff1155e564f3d2806e6172a98431fe744dd1dfe2d86f8a5f93004433990ad5c06ae8337fd0cab678a78707282566e51854a9b4f1c7f90fc1adb0e818361d0c69661384fa340488a9bf883cce94a0ad11f7444672cbbbc45b77c62123a53d51d8538cbfae99f2619311ea461a7be3303edc7cddd814c1d9b0a7fe60074e83a8de0c2f07aed7c7aaae7304e37cda5d15e8a8e007305805b84026a63c0565bb7ca06e1da43c2f9516181853dbfe1e6af65dbd2abe17c1241de5c34169a17f12391f64ff714854c150ccbfac975dee7b614028bec0eb28fff04336c565c73b7b26cb54ab5fbaede96c251129110e9b8b40d9392213774acd4f43bc035f3f2bedbe5e0f43528c973c215ac06e5a2b560ab150c186ecd6e01ed807407087bbc073b064202bf6fb16d284af6eabf8ebae3d013ee28a4a882e1bb21a196b4cbcec96f55ea667e1cb55f9f2aa4aaa3316dd2b260f8a8cc05960cd5d068d6304953fad5f9aba17d13912dc6b96928946ff2a6baea68974199787668c43bcc86229d2f377da941d9be0b17d51bddc03ff4ba36b2ea06570822050fd1c80bd0bb4c5c923f71bb3f53b45347964fac9fc3b6bdabd1995c8e27de1f334d58173defe7f27ea7f26b141259cabcf41e68a073d44af104f8790c83fa168c6b734238af43f057c7fa8dede7e09d618cb923a0e5c4cb65f8e172fa66d9ac00a6553a6b0d7e5ba4a15f337b42da469118d70fef40555b094fc8f3253061368211bea544ca2df713a3d7260473bdef56a5397b09df94c50cfeed8e151cd308ef10b03b3917d6b876fd7cf43058b8f9d8ce0b5e1305fe469c03bb06bfa9fd37abd109d9b35dd2f34c1892621df72254d324dcc68ff0c88c63e22ad6b99faa9a89c3bfe96d6bcdf09002c188ebdf4ea623edf33cbc4f1888fb80bcb83490e63d9c03ffe6dc51c3668b0d494b4e96ab724d8a6db09f9da49667634ee60fa680700f8d4dcc1eb1fe1a92b966d22889016d354c7e76cbaf9796257295ba38e19395e8580e9e5eb0f8bc758ef5bb79877166813742a390606cf9c1b652788e60ed60f8e58f1397614c10833fffd34d3e29c2fd7237da782aef650b1a8d31df6cceec987f750b268968568e9b3618fa39c5bd4b8eddb97ecaa905bd37b6630203263dde5ae895c156434c8779a4384410cbb19fb161c2cc59f18f6c74810f2567dd55decd09cb941708bd2281f4bf3be86370f9c17d00cf5603339e5124bac0eb6524326398e3defbbcdfc77a243d86294107c2c4ca9aa8fc26b1d0b3e0ea2d94522051458f89e1881dd1e8516b2336514635ccc6a8aa9a0dcf9628ec05e217443ca8482de333e0d8e1af7c611ee0631347ae36c8e676507ea4a4d57d220e13c20187d5f9884afcee3cc6cda31be783e6fcab7af425cede536b2f6f6f955cb39b9c71385943236eecbd0f29336191dc42b4250748922ed75e2ee7f21c9c8dfb1b4d5d00558965ca501d5e1cfd75914439278be0a6d8258efad4696b7704329ce4404218ced10658c2bb00dda7b5945ae2a087ca878e898b9621b94568ec9e9f1dcccc67e4fbdcc04aa5a620cbb7fc51ffbe7e6ea5dce91bf97201fceb7519ff9d1ef582b876c1daed5d26e77577292e7ecabbd96bdea2b363c0b9cea508494a69223028730003a27fb49daf4da82142e68e2afe6ca3a29fdfceb9e5a3582acd2398f216c6906bf87d010bbebb4e13e939a90fdd24e46334b95555819737c8800dbdd171e6a253d22e6f44a796f61ddd52682565c936448a057728478a6b50786a1488bf7aeb021091b9f63cb8aad3e36f1dea0ba609d2b103732462682971385cb2c3a25504a0d0d568c1a168feb5170c8882a97ecc551551f642d0b2a7ae82e7df1fd3ef3536d677b759e861227dca1e4ad1896b627176c5bc7cb7202033f53853997d49ab15fac7a6a4e9453c29dcb8d0ba3e9fbf6407bfafb0b0ae0d976920ec46ede3b0f372744ff0ad22f46f53b54a6a746061e58c83f30a5e9de8892c54bca906b201aff906b0482372dd4c5a062ac1f19a45dc5da40f2112205ccd99103c5cf7f82837c9988ce13bda528403309482b383d75fc1fbb0af6cd3661f0f4e6deb737608c36ef1892cdfb5c4bde1d11570a63c815b4008e03ff8987123a23f82b97ae55317cc97e75f79a2ad91a1ceafd15f5815851fe027e2e2329ab22810075607fee9faaba2a2ef8571589c94800af98c98cb551f758a3e3ed367027718845e8c31b9c9434218b3e5fc9a3b957f934a0409ae038a419726b97dbde619569f832acc8ed15e33c4e5a028b20c76b96d6ad20f78826429bfa8c175c337451a15d11fc80579c4251dccae364f41c080acccfdc6093ffe46edab77a1659153a40763295576caa83794d0b20422337bccec7720953b9d362abff5b110117c6a26d282b6ed771617034a2ffcda2caecd579eab02c4e144213baa79dca0f442112226274b2a45a24d1f229814e3fc949dc9fa37475218cc272fab57d1e7ff1f2714114de3a63033daf4a68f8d90b9c40a305a71162e97f2f79b51ccf2d1dd6ab53ab0b6a7ffc40df210fbd69e205683fbc12fe48afc521ea401083486cd49d89a42517cd03eecad837eba21d534e14464ef4dea27b27643deba7a603e414d0295aa0842c4ff0bce954437c3ef6451914537309b29349f4fd4d158375dd9a9fa59297d1fcfd6a04967dceb5101b03aea33cdaccf5fec1d1adbba67ee7f55e4c239afa080ac32fcefb7b590c61caa2f2fbf9e8580de9bc6ed8064a44c00d248276bdf6659c0dbbb2654eccfa93afd39ee254ae1112266517ed5c6b3faddfa6195cfa9ae7c8eb3c853c8713c47acd11048076b8c9a87bd1fd236402981260d6d28f94a6300e9590211c2e777decabf24592541d602d839728dd7da15c8bfda6e52e4468d42694e56519b747c8da75555d09b59cd743a7f5f8609a2c058ba044f55c269aca36a93bfc1003d2dd7ea5b8b3bb9bfb2f7b9619a3cb663bea2ba56689373f798c8df8aca42ebc609f412ebe2fec1458b57aada841baecd271a068a2679b15c9d488a133f3af287b0edb8a6663e7a542309a88b3bbfbee21b2a2478c2b202b82c28f119a5606cf47e5deb09817a31ccf9b48a5a3677215eec5a43ca8048864f21b04d5d6d2511555a5474c2debed0c93a3859396e2f400485812f0e248f083b1bf0e927e02593e38362311d3c32167c769c3287f3b69aa62ca3f9026263fc1edeb5fffe77b819cb10db855830d8f5d5c193a624e6383c82ed38eedc2b9e7007d48cf04f4f9991120a0292ec793bba72e190174a92879d35fe593e9b977702c17118ae80219ca53c4ad54ca6a8ed2fcc90f3f5736fe6e0bb94ffbfd96aa24fcafd96ade99565215cf33c43741a72c3ce68bee7677db1de3d830cc5e056a83981fc23476ee8762caaa3c54a5d0e124ae1411844ec31e33bfabc47aaf28f0070dbd0f3489538bf3e7903e06f15bd279140a243eb775d741ae754bcaf280c27243a0fbea38618dbbb6922cbbe956bd57fb6ea4ae4ecad41f6798ca83e1ebd37e85dd8fa0f0972c5fc3b65873159f8584ca4fa7bdd0642cbd00bd1f2b815df65d1c70d12cf3f67ab7c3b7c395e28321202719fad41b6dc082cbe1711bdcd8facb85c3f827f515b4b14fc2c282628ca40d95118f6f351ce1550451cd80cf48248e558ef7053dfae5af8c98dab2a5ee39ee28f5c08c5be6257dcdebd70e2b9cf922782dd8a5cf79532ce689a5faee4229ff425cdd5c010777d3f4725b306b1d6feb95110d20d4db909365abb3a522bb0f1f1f6f636a296f4e228fd035dc999a2c07bf784ababf4ad321059d29693362e48c023c38a64d2c1ef22fd1bce36c7a9212f3a1971dea5ba393a24eb67988216cd6cbf91aa8927a1c7a8d2732945e51f2d220d0f645e14179fc9b767455ea45d379c0b6781854ab931a807559a00041bfb1078ddfb857266bfb05e69bcfc49901132cb7b877d05a698fa5895b003de60b8612421ed0abedbfd5d77129bd49c8c5065e28498cbdd70ab5faa8d4b264aa7c28bf551f21ee37751f8e3b74df53926a8c55be5220857964901157d76ad9cb2efbdb1454bf74d767c22fdaa32d91392c577f92673bf333fc1b5ab91793bca82a297c8b2ce251fba089f3959b8af8fed8161aae1382c9fc5564f34a3f9d5f992c3b3731fa4c6c433aa2e63c24ff47276c29d1cfb8a1f0beb9dfda549927ffdd87e03bdca61740a37e34c16296f42413a6cff87f900e94c678876cd31a147ef3a405f68e2d91971adce724c97cd7643f75a0e732544509ff7439a85ff0247eda4ce036d0ea016bdf9f7aabbf7b4afbd2bbd4bc2ccb962e2f67197050b08e50860c44b327a2f1d85e161f22d1444456fb3e07f4b7f16c9a7f0d266ea2f50ba91c464be4eec93923e937cd6b531cea52ea2e46776612ef851bf576ddae66f63d4af086fc27eb4517ff302747d5ecbaeefbec5514d5e8702c345a33a3a0f680058b04b11a78ba5d50a8e54cde1c3b791f60b5bf3b0bfb61fe3251a5dac1156bd21d8d2da512b3517caface1fccdfde48c99875431f7bd563292c0078dbe4b509c404ae556aa74881b44ea9f68804e886a29ddc93d1839a81eb77773a61d93011194ff3be006a064ea255ade3320783cd08e13c4745af85700e63d6cb759a615729147341931ed148fdc217ad6d2c8248762664f1d6f76372d8ad2ce4b67a2e8c58de5ae755349b5f1d2c3096726c939afbd5dd73eced0356bf5d8a3475466a39648ce5fd7ebfdd3ae147ca89ce3f8df507d9606015d061de5b604b843c4f31c2c119c36d3571f6a15f116fa5c797d2a8f3e5e1c3db59ebca0808fd6b1a2d52aa1f981ff9833a6945eec0a32a5cc5e3f48cb9263da630477355a5ddff4b3cfa0249c8974145b2de9987452dfe04fa069fe3caae2ecf73238cae03fbe39d438d6b0ba94636986b7312e9a54f0e130ebdc89c998c978bde568bb175f455880140b309452595569fa8aa4bf406b0941a78c00e9aa1aeaf4886a603f894d2972bdd8d6fcc94af66fa6659a3a8824a8dc58ed3ddfba1903d1d3ded248bcfccf70f9c8010e43a22bc486b6daacbe9431e25bc7fc6c5cdd2e0562dd7c6a5930dc823b482c54c253666b5f674f48ddfc6dc42ccbe20be9b5912c3006d2234e24078d0776ba9c5ecdd7eb5e72fd8431af77be0feeefe7e558629fed4e9a7d0a874a0d07ceb19c831143dfa6771ab6a0b2a8f6e72c25df0176b689a040136b1279d59ad7085c8f167751a49c28616c27c832119d218b52e301db274ab3048dea308e4745deb4eec2a70ad73d4938fb088693258e26d29c10a93952f6e46688cdf790d7b1f0688e7ab241321a3610a1643d6294fa346ce6548e6550caf9bdf5651a2c1ead7aaa8d17502c9d4505190c20861a265649715e51fb42b3c5d9f85b4115e2f42cf52e87c410c47859ee22bce8257c1ef963f1dfd880bb656da56d512064b1c5e36d5bfca73de4ce694c02d6498c5055bf0bd73f1937ad5fc35f4d8cb4945514da9e5c2a4002e67e40c0e3f49d25f6d0b18ed920eb7c3c4d238cfccf537c171aa7d57bd4955aacab54df215d8772ae1446b78b0e74c1df1314116df359e7060e997d74f33fd961b45c4e558f13af5ccd7a2786f29618d458c181de65256b8d252dc9332889b758fb9260a41b8746a90b72d51c120a005ca994ddcac8d2ba29694f2f20549ba8dcdfe654d070bb72c4", "bbfbf1551646a950906d8059f132341ed0f55b69e9923a636d10d54669cd88abb6557003485ed610e659cb595b53fd060406c1ba81f9e5f3734c4b2346cdd0b5bec6513cceaae01505810240a5912929f844382deab6f01165aebc29a65952e356061692326d38ca8b8c2372ff0e2e9508a08a0fa653c55d9ad6b05d70ae01177d164444d4b95d1208a0f06d95ef98b39c1cc31740c304fe39bb63855f72e1a441d8b2c3600e89d1497a8e63f4e95c730c4d61da2d3f7b645a4af0c7ab32d97c895ea8d00591bb2f71a3b41b3d634434c4e4c06d0433cbbf060f159d2a9d131cb01880eb5645492cdeaea2d254b0da23719f244edf0320ae936a7a7ab01095750f21ca52327d20fac0e2e9900d9bf77389d27242f9b26e0abcb836b36a8e54c071b3f6379134453ff05840638dafab3c9979fc7adb85a80f0cefe05e7fea79cfa315affa0c77dd4c7c4144dcfbf7be39433979936ee9e0f1b66abf64d4a0c595104dd39d7db5afae07cac9e94853d3fd716e56422f777352d7ac123e9855589ff4599ccdc36b2dbdb8dceb93519ca4309e422708bc2da77fcff1c56d8b8e538a92759d7e7dad68724f5920154b42df3ca0e9169692ca5b8ca79207deb9b3f534b325840f3af09fc9f10ede46db85d136a6c9618f4f45529e240fc9aaebeef11d55b060fdbb27c0c78e5a8c2cb7d1728ff046732d97ab246b8a652050e69a676532e6610462f4158ea2ed528188498e0a684efa2b078fcb758ad392455d87c37d661feb479bba344d70e223c3d8975887e8fa6a4e322394e95a789fea6f0084c84fa47959236f6373d7dea909c7cf1a99233fbe8cd9f2ccadbc37b309cb13f27a34358e8fd91839715e37c3b09709be968a6bb7bc30b7181dbedc1033b7d0ff8a52e1719fa1068859aca2066e91965c5ca6b5141dc6a95fa10a04003261225263f7f07ff5b29d43ad01d2316bffb5b84ccfcba287346dbfcd200c82c76e9d263643b67b4803cb95e618cb0407ede749fed53d352b63ff4d399fa16b4ff4dd9c4e4ceb0e3549ac585a3f147c5e9a84a28e3918c8a1c0bf25f983f2dfec9f9875b368a30ad33c207c6ee618c9153a430e73b393c18e43dd586fd892b5fdb362c51768111fffbdc2be3d193eeecfa9a2bb8862278cef7b667a3b5d857f4d61ecb4099f69e6c1937c4f7298fd4bf39a4923f66873f2595c441ef7de525859195c4429bbee92f009f9ec8c90a6c7c1a5c3877b4da67788424823f62994ea2d3febc9304a80a348f075f60975ff409ee2630d99034e5c4d254a1594498c0185580a65007155b02095a4f5dbe24ee0fb2a1f5b969c7083edde938efa18c037060bc44ac89aa269203de41cc698e9f6cb1b429a98a59af9abbf761e6c922b099d5c45873d57710af99690bc06158b35bceb990e3b9174f4cb63f02c274b048208edee0f3503d696454e29317552a3072a2e7fd5159d7e399d9e97ac2401edf782c83077c19938a3fb7ee2a64a7db7d8918384986ce1c9a06f450f61e24de2e9dabe9abf1038c22447173b2e0895eab1361fd37ca55012967d6cb8e7dad8b94e318e02af55dcc977544e71d2c0e530d3e1a2a866ad78b519997fd56f766022ec25486841ed9a38ee1343769593d84d58c3c59872b12ab5ced66c855f518214e9b09e672b5c3d7da780bc88bded73f295c95472a489402fe189136252b2129657ab0f1c9a8fcb2b005d061804ed31db71ce0fca5bd534515e99d85501daa3a91cad9c1acdec7916399ab148d0ca0f98999b33b9a22df26b8ed1a3f631c60a15bd96de3efc052c106aa768a69e2dfa7d7081bda53ade01a65ecbb30ef75282d56a76c855b619cc18c63d68337ec4ef06f4e46a122e4cffcf6306facb1b46ebe906cd6e20d3e557effee91c9e6aa0f7ca41835f6129f9290063e5073d34b1fa74d651cf9487e5485ae6d39de826cdf2a1ce88759c7663e99d57ba31a7e0ab539a2e874468bfcfbe98b5d75c3e1389b54ff295c704f0a31527286979bdb1f219579bb9af7aa1121a10766252bbf8f84ecd0883f9c25d93cf2fd604c5db809c40cc4caf25999c5f77d220eb83ffefe259da57fc6f9697e83543b342a5290e2e811c09b1b9d9faa556d89a4f0fce5f76d9e347ff11a9b3d13bd6635ee5c7dd1956101ef2a699ba1383a38c237598d11415eb11e7b63ad49876affe493af7a1b7ee31837c46086ed5816ac69bafcfd48f3b78a086b962ed5bb3c5c486b3869f10f0f9a35129f24f85bd09c9fa96b7d231d120a5f2667d5c65594cba62da48c6b6a579d22e716e962dd0bf46b20f38b28755029f04d0a5aa256381f7856a490c28bbe92397b8ec5d109b8c99d59cd8f15d622c2bb10cdcd4a0995f07fbe7be21606c9e29b030861529663a6f3fa4a8c547dccb8eba8d2c20f125b18de21b3a95d0b19cff9686a9183a5c46832475979b65cc13adef578c461415916ca0c0f3764f0546ffa065b08432202456f6b93abde77bdadfcf492c8a255b25ae06d46f20e28bc393e6663c05f14ee35620e7a3b5500cecd972644a22fa43652d9f86c74be4aa6d97210350c9a0c4760c04613ee4d39260ff9346a1dea326e0049ef1b0aa783858263ca0864f6771ec5f75cf8451afa98a94d70bcb1f42f14cdb6cf0c87edd478eb7843162828875c3f323097976c03415fb90d4ac4d98d32e8bf9c1068a355cc079675a86be763d2abf60b8e80efb2eb0ce8eaae6385cdffe9393a1b81edc4769f99ad2e0c12c9098492499525f182aad2188115a803e2aca1f767cd959c0bcb21c5e4f1511684c0b842bcb4208887180257432fc0c02d7b401b5cc5543effffb9bf157175c04adca69c9ded47d2b9ef7dbc6a556549959498dd0b46b2cd73e16948e4aeb3ea535d18801c2cc676eaf93468da9c3d0d52025e71bfb673ff51d589cff0b01aa9acc6450b19f75aaa5be026906b79a39ffe377b9b22e6f6d66ef9c11b96c4147347bc12f146d5127835c805738e654578a3dd54b453dac9da7bfc77c3a70c5dfa2e57e6f5105c2dc93c859756dbe06fbf938730c2e1aaa3064f1b89141994382ce039aca3ac99696c6aefd4632ca47e1713b01b172e658f9fff5d102f780f96cf666a8f82a4b73eaf0fded5b60172e451b784bfa246d5f080492fddc93f7a88750fe707d2fae2f60afc35bb7ed03f93a74ea4391ef75d76ac4729518dd60900ca78f70899e8ebdb3a51b2aada7ce2bb8f564b4c65087ff34e9c9c8a70c4dba80bad3c888327879b209a2cdd122ba6adc6356c3b4a33b589c190baf29cd37c1fd2c1ca44a5cb397cc0b09cb47f38c5215bf2c390411a416c4afebbda2cfb63bcc5a233a6e72ecec56e840ce6c5ae5f766a35a2ac804838e33b346f067bd74ec45a66d94f632e8f2fdaa94993ae08593c02307131df51850a687015f7a78be88a6bf7045786e6dff7dc3c5f04bd8e377e7a9ae0739bbeb730ecf1fd53ae7b919af535e9b7780f73707a38989a90ec3a03c5e424214e8f2c950317eb4718dc39ab7bbdf6c6f039ee31f3d1a8e8db14044415b7f896a3e353964bd6f3cc31273c170789fa9a349d884d398754023c2c499edeca622042b57ad9afa0f15c47f879057488dadd95fa2e6185e97eb51b967cdf9aa84f33e050bd23a6ebcbf2b2037ccd2286fdaef7fe544e10d9930235cca43c3d5e11d5916b2f687cb07a4bd9f0be857c38a9602e2e5214263a7c68447250ad426a3b00b22dd19c495ffd45db646239c9c74e22b8ad0ebfde3478d7e108144c165cc54b0f19927e81a02309846e22f2e8c8758c4bd6ac2f565896a653113f7878a3729f7a7ddda656c60d6aab8192bab636ade1ca70c13f76a4f760d203b11a4ec29a9e0b52d95dfc76b05c319d4a34322dcb2931aaacf5d198bf4223093be93ef2feb9b8aaece4810f5acd026f4c21244f549c433d4cc0012bab66f8d595433ac7a511c8aa2d183c86a7738a4bc319054959e4c509f419d97e76b75dcaecdabd09487d246beabeaaa5c737f4862ee1df81b0122ed346b82feca73ac2f1a7240bd6c00ca64574f0853a3b10e84ecd6eb52466abce7d3659ca2f6b44b8bcac3ddbb7750e689e2190b0c2c4fd3d102a6c5a8ee2be2839c8f226763d0f718202286f260298566e36d040892705bb5d17e71de0a17b163896533f1e54a242498f8ef5ac68b6a68d32f72e0222c3a1c6ce051aac4a69be39434c3a63bcc318faf7fce058d32e39f3540c63e5bb734810c80b812811fdbc8a82a3f7460a5e649ad94c64b35faa8ac6a51565e78056ce0b8397e0334a85909892b920d014184b49ddc6bc14c2f05b0a7e29b1fe7f59d29a709a89147f2d213c2aa750c521386fc44f98fd296a9873e19f0721c4c59f8397666888a3d038a702adee80539e924bf8da34a9c82854058269929f23b8e851ff18aebe066104aa2e92ae77e94c673d31ed9c391744a9613946d60abb8bb33d31b220c6a6951b0896ffa78a2f77d083a9ffc504a9b2d31ee56d7fede268ff12fe4f24bf5cd4fa86aabc47b9d39b6cc25f9955452fc632d635a10313a95a2e92f0defbb7af0c86e4f8a159219a7a77460274106f45acfc978fd58cac27b988277b24c1c43e8b8bdb38a32230dccd9c7b5c6cee68467311175f0904542a5f9ecc878db214ea3fab7136f60b6e0c9de3780d840c3b62c2c4f37e3ee98f2e4abf99ddf493fd6a068d612c39e4deb95f516d83a4cf5d13a28a7ffa8a271e012162c5a9f871b6b8529c4320e7709fd106f8a8bf70955b776d88d383f73eedeb109101982a0e740e646b9142426ace4a8aa1cdf7424376531839bec746cf352f6cc6b2f04ae2d5830c19a3554320548162e97e2a0c7f3a0f13b986e355aa5d41677c66b29bcf46b4bbe1a655ad9d5c852d3be0ba225b0b8f697b4ffbab4171e4f483bb8fce4e89abdb84b01c9f7b328eee12eb4f3eaab33cad75150699622be687b797706edeaf4203d53660820bf2d9272b1a29a393e7c6c6d1fa0218f3bb57e278e993438acf09b18959adb23822a8cc91e84c06836e7d90d628b42e141d90c04faa46029ea885dc810e46ca695d4bf153ba91dae4fcc0883080c528adca8a2ca762359f35e76f016f14f2ae816d285f85fd9ef66d251662dd52e8365d581037d4f43c4760d8a5fd0e11764d180f01f35bdaef5ee61336fecf660f6bf4594d945d4c3e81db57f5804975e96e97945657cc9b0289381c302b700b425c74e52a20f670d48295131a47cacc24c1e5fdebe3b36530e735976f18c1641ff83cb1057d8f3af968d0616c9403a9d2aa232ace5c31b5992bf765de553cbe06f2aa36be322b549d7ff5414847a61c14be239193c71b6187357378521512baa3d06ffe6bd83a19595e62f0ccc15d8ca649d2c746c4b4d882f898ba854c97cf0ab0c5d18cd76f92b737be226af485deda1d5fbe980816422e5661e455826400d3d3669106d418deef53af23785c537933e7697a98269803df14077c5a8028be2e06f2abbcb71c1d7b510b4764b1e40458f3a459f603afd2883882d3ab6af08c506fdc4659c19d39df735c4029c46febaff44aadb89ef1e0e10deeef0a7ff043f0108c98b5b92d6683744ff07edc6ea0e2c2fc55ec12c9a5f179de1c80931b5eb353bfc11e7ce54b9f3f5b340bdaba03a68ab6773bb73b868d3cdf3379a652dae0a1df4287850f21f08bf18a61e808920127572ba997b045611caa046501ce9971cf0b74f9003dce0d567c283433cb7858312cf51ba7b8f43bb459f25a48014927f7cbb7cbca704496c172349"}) 21:56:05 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x1, 0x40000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) 21:56:05 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r5) creat(&(0x7f0000000240)='./bus\x00', 0x0) 21:56:05 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x8, 0x301) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0xf7, &(0x7f00000000c0)=""/247}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) syz_open_procfs(r1, &(0x7f00000001c0)='net\x00') 21:56:05 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x10100, 0x0) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000200)=@req3={0x2, 0x0, 0x7, 0xcb39, 0x100, 0xc2, 0x3ff}, 0x1c) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) pread64(r2, &(0x7f00000002c0)=""/132, 0x84, 0x3) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$TIPC_SRC_DROPPABLE(r3, 0x10f, 0x80, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f00000001c0)) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r4, 0x80045500, &(0x7f0000000280)) 21:56:05 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) ioctl$TIOCSSERIAL(0xffffffffffffffff, 0x541e, &(0x7f0000000400)={0x3, 0x1000, 0x9, 0x2, 0x1dc, 0x42b, 0x877f, 0x10000, 0x3ff, 0x58, 0x6a, 0x3, 0x1, 0xbf, &(0x7f0000000340)=""/137, 0x800, 0x4, 0xd6000}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) write$vhost_msg(r2, &(0x7f0000000040)={0x1, {&(0x7f0000000000)=""/26, 0x1a, &(0x7f00000001c0)=""/241, 0x1, 0x3}}, 0x48) 21:56:05 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r5) 21:56:05 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x800) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0xd56f666b420c93c4, 0x0) ioctl$VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000200)={0x8, 0xa, 0x1, "54d8bf5d69c1102f646927b6f9bd7ebb6a281ad5526ac388d1b68a7d659988b3", 0x20493859}) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xa0) ioctl$SG_GET_ACCESS_COUNT(r2, 0x2289, &(0x7f0000000040)) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/mISDNtimer\x00', 0x1, 0x0) io_setup(0xa, &(0x7f0000000000)=0x0) dup3(r1, r0, 0x0) io_submit(r4, 0x1, &(0x7f0000000240)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 21:56:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:05 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) prctl$PR_GET_NAME(0x10, &(0x7f0000000480)=""/39) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x404000, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x1, 0x80000) sendmsg$AUDIT_LIST_RULES(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x10, 0x3f5, 0x200, 0x70bd29, 0x25dfdbfb, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040084}, 0x4) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000440)={&(0x7f0000000340), 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x6c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x3}, @IPSET_ATTR_ADT={0x30, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x1}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x3}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10844}, 0x10) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1010c0, 0x11) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f00000006c0)={'filter\x00', 0x7, 0x4, 0x400, 0x108, 0x108, 0x108, 0x318, 0x318, 0x318, 0x4, &(0x7f0000000100), {[{{@arp={@loopback, @multicast2, 0xffffff00, 0xff, 0xc, 0xb, {@mac=@random="6a20e22ec18c", {[0xff, 0xff, 0x0, 0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, 0x5, 0x1, 0xa5, 0x4, 0x8000, 0x3, 'bond0\x00', 'veth0_vlan\x00', {0xff}, {}, 0x0, 0x18c}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x1, 0x7, {0x2000000000009}}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0xff000000, 0xff000000, 0x10, 0x1, {@empty, {[0xff, 0x0, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff, 0x0, 0xff, 0xff]}}, 0x1000, 0x21b, 0x800, 0x2, 0x9, 0x1, 'rose0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x84}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "3fa56091944be3fee4ad55a070cf627efd6525049b315cd0ebefd224c7f7"}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={[], 0x29}, @broadcast, @multicast2, 0x2}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x450) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f00000004c0)={0x0, 0x4, 0x0, 0x7f}) 21:56:05 executing program 5: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000200)={0x3, 0x0, 0x1, {0xffffff81, 0x6, 0x1000, 0x3}}) io_setup(0x1, &(0x7f0000000300)=0x0) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xfffd, 0x40300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r1, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$AUDIT_USER_TTY(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000001}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x6c, 0x464, 0x4, 0x70bd26, 0x25dfdbfc, "7025066257dc90ab7e0f77137448f0fe1e027aa67004513cccb7a111eb5e4d62e54d180ab69ab93781931ba81b5ba793d2a35cf8fe585e505d9f58e0ed89f5bdfa9b5ddbb1333cd440147214277287bb3d064becbb8f00615c", ["", "", "", "", ""]}, 0x6c}, 0x1, 0x0, 0x0, 0x20044000}, 0x11) 21:56:05 executing program 4: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0xb, 0x8, 0x2ef, 0x0, r0, 0x8, [], 0x0, r0, 0xfffffffe}, 0x40) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400002, 0x0) 21:56:06 executing program 2: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(0xffffffffffffffff, &(0x7f0000001c80)=[{&(0x7f0000001d80)="d083b8778d9e055daedb2fb28df629afabdb0b25311ef1e77295a000a43e2610b846a5a59c06a800d34c3ef145cad9aaddefb439df1beffe701249890b0ea7339ca9794b6cf290548aba931a5059dedce4d27e6263d686d6f1504ecfc3bdccec85c073b5b71f298737ae4c7e96b8d6df30992b9ebb753ddeb1e0dc66f019618e868a38371361d6110edab71f3ae2fc04feed51cd887ac2bdcd241d92f7b1aa9d7f70541143aba6248bd0177732615c9f8a54543062e599a2cee171d811a917a4b0882ba5def07b3260ec5a082886d87825ee35ff687ab6e3e839fdac019fa5b80050a65f59a68fcc976f7d911189f30cf92fa5ad021dea92d00d3386a5d9bb62c65e3f7ecb19ce0b5569d6d00e883d28b567c21ef82e8545dc11ebbfd946a10a405dea6534a7c18fbedbdf8d71095deebb9347d6116033825427b0148a45162861088bba8782b9dae7f98f81c36e9d11598bdd5e79782e521fe881ab8589b3050a5f8845293061641a957bea70b9521111fa0beadf746e1bea12847470d3ae39f16ae293f7ecafbaf1315a77b281e82b87e852f366e36bc4928634cf89", 0x19d}, {&(0x7f00000016c0)="7507747dd9bcc24bc9201e9ab3851c2352e456a59990f36599f89b848cf73dba62e0ee4d214b4ea417ba047283d923aa85916b00b017843fb4dd334d8bf4ab10c73e81992e6fd44138b794415b5cc26106b7db3a6b8796ce064e031f8f35e3f749cb730bb38dcfb2cf9155bf417d427a6ea7c2284e317a87736058c4140d8fe5d67450f4e38f91d2457b", 0x8a}, {&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba24", 0x97}], 0x3) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fadvise64(r0, 0xffffffffffffffe1, 0x1f, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000600)=0xffd, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 21:56:06 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) close(0xffffffffffffffff) 21:56:06 executing program 4: syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x0, 0x2) openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2e101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video35\x00', 0x2, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) sendmsg$NLBL_MGMT_C_LISTALL(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000400), 0xc, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYBLOB="100025bd7000fddb5f00106b4ec35f80ab94690bc870d6410f4e8db60e28400f7c645d8e43c146ae26ba422e1ca70b0351887465e7eab9ce01036590bd0c31afd092c010d3a282a4e77b8640"], 0x1}, 0x1, 0x0, 0x0, 0x8010}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000440)=@xdp={0x2c, 0x0, 0x0, 0x20}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000004c0)="d863f0b8958675925abb247d5f99bfd27ce968c903827c18d975af396a4c01aba1d859e5e584e4e5f1252057f66d08272a51578ef46f9fe109338b5b8e1d6afe429be5a4edf20381385c0353a185345e9bac3a38c6ee71e71c80769892a2e9509f", 0x61}, {0x0}], 0x2}, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffe6dc}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x2}, &(0x7f0000000000)={0x0, r2+30000000}, 0x0) [ 2469.853184] selinux_nlmsg_perm: 324 callbacks suppressed [ 2469.853195] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 21:56:06 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) mmap(&(0x7f00005cd000/0x2000)=nil, 0x2000, 0x200000c, 0x4000050, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x1, 0x0, 0xfffffff9, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfffffd93}], 0x1, 0x0) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cachefiles\x00', 0x2, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="400000000706050000000000000000000300000a0900020073797a320000000005000100070000000500010007000000080006cfb0c7dd861faeaca2c60094400000000608000640ffffffff14440931e1897ae49c63dc2639e251f09be317b0d7991950dd7c5876c89e79e4875d4ab7d9f82783f285b6bd69169958f4a72e53df0800fc484d3eb0ad3925b52635729a021d5d2268aa9d8c666a73aba359ce7ccb7145fa29d33cf1d0063df3d49bb98f1e5ac2c4ab128d2c1545a73399c09bfb44d9d5c199f885"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x40014) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)={0x14, 0x0, 0x400}, 0x14}}, 0x20040050) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="000227bd7000ffdbdf250f0000000500d500010000008e060f00c28fff88333c342e2a3102d4edf92ef394aa5e83adb86efae155f53e3df66e630791695699679dcce5b4269ded6a8625c8d607406cedc821ade12ed3c0cb31c1cd81e57eb2fe445217eacf9c9df7cce4446f8fe6eaeb4d14c5bb6a292c85970dc667e22c609e98e1f648d9cb5abde64065666825f067828ad0301ee8ead529cddb601b75819d898312b407cbe8f878c9dc01bebccd51da1cfef7b8fc966551fd9139a5ec0804858414afba8e95c4d2a8d58459b3b217f718d290598c822ba1146e99c27164580e40867ba97bd8b7e7b2b3e93109d372f43948b2cdcdb8ea21936322df68a584dafc4ff424850ea055fe26ab43be574f0bd8cf3cdcd90fe5d8af633646d5ae67d8f2651ede1aee0d001f16dab084adefca21025109239efab68fddd71809fca73f743df52cba7e4bbdc347273b160442af416c73212f997f79da81a9b0e151ab537197ba6692ead2b5078b00bf342fd9e6deebf11f5f9e5b8653d7148e442f14c8154d3f1a493946d7b32081b3ef3162c38ae0e11c20e578154206965f74ecddae77ee9b013a91fe671265845279818a742c2a30b85e3220582d45e880996fb257a4c0a8f6f564e61996d22dd580961a7c6eb62eef90c1ec0e8ebde7faf45d5d7a1b6e87b6020f109f83a549292bf8dcde0838c85a00be1d41d9f5d7c028f0919ea8489dddf60cba1d6c89e36cd46444ebc7e7e688dd4a0650c0ba75159313957ce652570dca226090967c96f823284b8f6bd6f47f665044966618f92411fa02170f10645fe3eb84bed85b68a8d2eb4be026086f6f77c32300a68ef0fcba1f0367859e3ca7af5ba3a33fc9c521f7520723546db01920b7a3e277978b88f3716307100feec50d59cc4e1afe36983bfd9e0ea96a427e583fa7a9df458ad84d57cf2fa83e067e0a8a6b9dde190ed6cb62b5fe5b581d6ec205c3c035944a030477c6dd8c16facd5656fe059c9cd5cf6a84bdc61d5f2bd2237afcf4e0feb459361f2efb73b68ffa494da82d73f5250deb5ce0e84b4c8d6fa1d738dd7be4c1beaac8815ff0bd409343f936e71edab4938e7acbad9ca00099745c5db7afa62fd075d8eac8ff77a1741ea11dae26441328c7aa0bae4f76abe38ff5c475fe2f3f085c7c378b15e77f6f581e38f74a4f4903f884ee3c60c1dd3217ce0c1721fb3ad04d56c5482f1b2cf47d1819222752d2ae540a2adc36c17a16b794335206760f9bd05f2bf988734bcb072db7c3f952470f36e23b850a62191163080f5c2cf2164094e33c124c9f96fcfda4fd6bf00681a0dc8f06109b1b6036188904451f88c9ef2877b5269616beaf5894bbcb4b36537f32dd5da5c97d36596bb1dc52ddb12b19fe7f4dd2145c7a740b6a52af1561b1a48b99e2b8dc54d3b0dfc263ea34095499f9c80a57d6e64ec7019f3f4a4300363a40353dae8a21769ec66351642c065b4d0240d26f6e4597f5fe5b75f489dd7cb0668f55587f2d6631360bafac6b0e3f08862524261dd62dadf2a095471a48586a00395a3fc4de41802d756011ec211072f489229784fd9fd43ed2eb79a105680e3592418c2f16a4093f8369d9dc9c6765c2ea87102e8dcf45381725cacf9d6e33c31bee97cf7cf3b21b4cc41edbf376580a39fa4a956ec1fdfde7c6e8b7949be82ce0c3621abb0f0ec021a4a3fae1023bbfe0f78cafd8c30f91bb2d440fe5a9c0422f9a0a94472fdf67fc773262d6bf46f096e56eb4b74244b23800f750144966169c8ef63c57dbd3b4b21331f49f3afffb5ac98bf7e3d3dd3a4a5f420343e020fbaec765aff45410cdc55f74de8e033bb20612cac584eeccf4c569ed0002d5c6d1bf06f0cf9917bb70fa5056f23e36b2cf948ac80e0f28af7fdf3823a2911b2a64670d6f73aa46ce852b7d112cdc06033382994bfd04728479635c7eeca0b49eecbf37be38849713309b899b1fd0d5dde71f5b4004d18ac2aa5d328f1ef0c52e0fcd98d787d9715e3bfd8c24fa0ea5cbb0fba7047e4fec4bd053430e6e25f66edcf9755a0c72a1d9cb0affe8e3f165e93ef128f37e46b08c27da43cbf6cc905646eabd2d4e29ef7aa4c50e33ba1f807a1f6d29237de012370c1ebf7085aae6f5292c1befd1cec9a64cc2942cea6754de4a53aeda96d354d877b21e0438753f178e026b64a75719eb663f907fcacd330998b1d55e7c6ea3ada48890abab320d351910abdc48fcdd5a7ed117479f2b1cd4451f911b4c4a0e2225c2a965b8a4e3c24cb14d661ce1bf0772e3ca6d2df72a15f36ebee456c172476ec476c111631746387131236d73a338e8cbc8898447eeb7debf2ea503d079956fa69013789b803b6c3d77db6e6a03c1cd5a0a9e9d5ef84b5434f4b5adb587000054000e800400010004000100330003007e97eaf8ff90fa58ab46e0abb783a1ee4b009a7b807e5809224ff01090b41f675d315241cdfbebbb1d6f2891c98fdd001200020004f8a071922d83d13d9b64fb02f000000800490001ac0f00c7002a00858f1a3d6a67aaa693839f64748d753933bb69a5ab4d0aa91cbbf3816a79fdcbfe7f60938a4090927ec9685be9923370d416ce72281dc2d539f49e04f2a3df1d153d4449f0bffa52d125ceb00e1726c4bbd46ed8abd23f0dce39554f149ec94d4b3bf6a85b3f97fe52b9c88b5a0dc076e5affe3f1b8bea8fbffc8252af4e50d0f70586ea961a83a0067eac2fb9885cb261a46860f4830c8f7ce271837356ac299e56386f5444497d1dae51d1e41d84aa2fbdc97eefbf777b3553a272c329e8bad7c08200"], 0x7d0}, 0x1, 0x0, 0x0, 0x4001}, 0x20008004) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f00000005c0)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @ipv4={[], [], @loopback}, @local, 0x0, 0x0, 0xfffe}) getpeername$netrom(0xffffffffffffffff, &(0x7f0000000380)={{0x3, @null}, [@bcast, @bcast, @remote, @remote, @default, @bcast, @netrom, @netrom]}, &(0x7f0000000400)=0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) [ 2469.930755] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 [ 2469.978797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 [ 2470.008977] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 21:56:06 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) io_submit(r0, 0x2, &(0x7f00000002c0)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x6, 0x3, r1, &(0x7f0000000000)="3d7ef76f8ae5d8e8035bcbdff0548fc0d2338308fac36c9f1a29ef34fc2cd2dd", 0x20, 0x3, 0x0, 0x3}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x6, 0x8, r2, &(0x7f0000000100)="41784a88e3389503655646d08f03a6d35a793abd27491626d748b6449d130be04eb620c94dfa135cb6aef684f048d1006ee1193b617d4385586a2d700f8b8f8af961ff4de3b62b233ea5f1ec9f808cac992958f756dc611934bf80ea66444d9612b1ee3245ed269591d6974dfab740cc413eebb286d5f5926c919277b256028a918b27408d1db6ae1d1875cc5d82a2", 0x8f, 0x1, 0x0, 0x5}]) connect$inet6(r2, &(0x7f0000000380)={0xa, 0x4e24, 0x3, @private0, 0x4}, 0x1c) [ 2470.030230] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 [ 2470.061356] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 [ 2470.081107] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 [ 2470.105920] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 [ 2470.219502] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 21:56:06 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) close(0xffffffffffffffff) [ 2470.273524] sd 0:0:1:0: [sg0] tag#2998 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2470.282430] sd 0:0:1:0: [sg0] tag#2998 CDB: Read Block Limits [ 2470.288430] sd 0:0:1:0: [sg0] tag#2998 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2470.297348] sd 0:0:1:0: [sg0] tag#2998 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2470.306264] sd 0:0:1:0: [sg0] tag#2998 CDB[20]: 9c 09 3f f0 09 21:56:06 executing program 4: syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x0, 0x2) openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2e101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video35\x00', 0x2, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) sendmsg$NLBL_MGMT_C_LISTALL(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000400), 0xc, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYBLOB="100025bd7000fddb5f00106b4ec35f80ab94690bc870d6410f4e8db60e28400f7c645d8e43c146ae26ba422e1ca70b0351887465e7eab9ce01036590bd0c31afd092c010d3a282a4e77b8640"], 0x1}, 0x1, 0x0, 0x0, 0x8010}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000440)=@xdp={0x2c, 0x0, 0x0, 0x20}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000004c0)="d863f0b8958675925abb247d5f99bfd27ce968c903827c18d975af396a4c01aba1d859e5e584e4e5f1252057f66d08272a51578ef46f9fe109338b5b8e1d6afe429be5a4edf20381385c0353a185345e9bac3a38c6ee71e71c80769892a2e9509f", 0x61}, {0x0}], 0x2}, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffe6dc}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x2}, &(0x7f0000000000)={0x0, r2+30000000}, 0x0) [ 2470.350947] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16084 comm=syz-executor.3 21:56:06 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r3, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r4 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) io_submit(r0, 0x2, &(0x7f0000000440)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1, r4, &(0x7f00000004c0)="4a02106db4976ac0df4c08baf1c7e1b1cdcdcb432b94a129a6212ae1cebf9ed2601cfaedb91b7a445ea6c679017c5ec40a642544bad8dc2bd9d0955bba1e4be173e3bf52b9aa100c46ed7dc90cf24f2589e71eb4f8fff11863e1f26dd2a0f287b28e5b9b84c74f138d5771c3638e18204ec6c9776016512d96a5a456003b424b0dd1d23c2c2216910acacc1a30db00856915495d025cedf409d39cf61d97b1d39b7479c0b21e2fffde7bf99d483613b6cdbadd986e26a240bb3bb0c4eb5c2c81ad14870d66a9245969df454a11296bec3a532fef8ca8a20b9c1833d178d35a", 0xdf, 0x401, 0x0, 0x2, r5}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x7, 0x1000, r6, &(0x7f0000000040)="2256348ca459ab7e08ab833098c1ab99c2f16296e3972127823a53c2948d19bc58bfdac678659e", 0x27, 0x1000401, 0x0, 0x2, r2}]) 21:56:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:06 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) close(0xffffffffffffffff) [ 2470.601030] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2470.609946] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2470.615986] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2470.624949] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2470.633831] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 21:56:07 executing program 2: syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x0, 0x2) openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2e101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video35\x00', 0x2, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) sendmsg$NLBL_MGMT_C_LISTALL(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000400), 0xc, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYBLOB="100025bd7000fddb5f00106b4ec35f80ab94690bc870d6410f4e8db60e28400f7c645d8e43c146ae26ba422e1ca70b0351887465e7eab9ce01036590bd0c31afd092c010d3a282a4e77b8640"], 0x1}, 0x1, 0x0, 0x0, 0x8010}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000440)=@xdp={0x2c, 0x0, 0x0, 0x20}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000004c0)="d863f0b8958675925abb247d5f99bfd27ce968c903827c18d975af396a4c01aba1d859e5e584e4e5f1252057f66d08272a51578ef46f9fe109338b5b8e1d6afe429be5a4edf20381385c0353a185345e9bac3a38c6ee71e71c80769892a2e9509f", 0x61}, {0x0}], 0x2}, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffe6dc}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x2}, &(0x7f0000000000)={0x0, r2+30000000}, 0x0) [ 2470.774315] sd 0:0:1:0: [sg0] tag#2949 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2470.783388] sd 0:0:1:0: [sg0] tag#2949 CDB: Read Block Limits [ 2470.789457] sd 0:0:1:0: [sg0] tag#2949 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2470.798454] sd 0:0:1:0: [sg0] tag#2949 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2470.807467] sd 0:0:1:0: [sg0] tag#2949 CDB[20]: 9c 09 3f f0 09 21:56:07 executing program 5: io_setup(0x40, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:07 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r2, &(0x7f0000002cc0)={&(0x7f0000002b80), 0xc, &(0x7f0000002c80)={&(0x7f0000002c00)={0x60, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6_vti0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r4) 21:56:07 executing program 2: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setpipe(r0, 0x407, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000000)=0x5, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a106f4}}, 0xa0) write$P9_RREMOVE(r2, &(0x7f0000000100)={0x7, 0x7b, 0x1}, 0x7) sendto$inet(0xffffffffffffffff, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="0200029e", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000280)={r3, @in={{0x2, 0x4e22, @broadcast}}}, 0x84) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/timer\x00', 0x521002) splice(r1, 0x0, r4, 0x0, 0x30009, 0x3) 21:56:07 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) syz_genetlink_get_family_id$smc(&(0x7f0000002bc0)='SMC_PNETID\x00') r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r3) 21:56:07 executing program 5: prctl$PR_GET_NAME(0x10, &(0x7f0000000640)=""/4096) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="b80000000201010200000000000000000300000160000e800c000280050001000000000006000340000100002c00018014000300fc0200000000000000000000000000011400040000000000000000000000000000000001140001800800010000000000080002000a010101060003400003000008001540000000010500010006000000060005003f050000140005800f00010073616e652d3230303030100006001240000200000807074000000005"], 0xb8}}, 0x44090) io_setup(0x1, &(0x7f0000000300)=0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r1, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000000040)=0x1, 0x4) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) 21:56:07 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$MON_IOCQ_URB_LEN(r2, 0x9201) r3 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x800) ioctl$SCSI_IOCTL_SYNC(r3, 0x4) write$binfmt_elf64(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB='h'], 0x1) setsockopt$sock_int(r1, 0x1, 0x200000010, &(0x7f0000000040)=0x1, 0x4) write$binfmt_elf32(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1) recvmmsg(r1, &(0x7f0000002bc0)=[{{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f0000002a80)=""/95, 0x5f}], 0x1, &(0x7f0000000080)=""/62, 0x3e}}], 0x251, 0x0, 0x0) 21:56:07 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r3) 21:56:07 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000040)="a1", 0x1, 0x20000004, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10) listen(r0, 0x7) accept(r0, 0x0, 0x0) 21:56:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:56:07 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r2) 21:56:07 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x2) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x20, {0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, 0xa0) utimensat(r2, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={{0x77359400}}, 0x100) 21:56:08 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r2) 21:56:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f000000c0c0)=[{{&(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @initdev}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000140)=""/28, 0x1c}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000180)=""/57, 0x39}, {&(0x7f0000000340)=""/65, 0x41}, {&(0x7f00000003c0)=""/154, 0x9a}], 0x5, &(0x7f0000000500)=""/123, 0x7b}, 0x10000}, {{&(0x7f0000009900)=@un=@abs, 0x80, &(0x7f0000009c40)=[{&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/125, 0x7d}, {&(0x7f0000002b80)=""/201, 0xc9}, {&(0x7f0000002d40)=""/4084, 0xff4}, {0x0}, {0x0}, {&(0x7f0000003e00)=""/80, 0x50}, {&(0x7f0000003e80)=""/174, 0xae}, {&(0x7f0000000580)=""/168, 0xa8}, {&(0x7f0000005740)=""/136, 0x88}, {&(0x7f0000009bc0)=""/115, 0x73}, {&(0x7f00000001c0)=""/31, 0x1f}], 0xc, &(0x7f00000040c0)=""/77, 0x4d}, 0x6}, {{&(0x7f0000004140)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f00000054c0)=[{&(0x7f00000041c0)=""/34, 0x22}, {&(0x7f0000004200)=""/131, 0x83}, {&(0x7f00000042c0)=""/12, 0xc}, {&(0x7f0000004300)=""/49, 0x31}, {&(0x7f0000006f40)=""/4096, 0x1000}, {&(0x7f0000005340)=""/96, 0x60}, {&(0x7f00000053c0)=""/68, 0x44}, {&(0x7f0000005440)=""/119, 0x77}], 0x8, &(0x7f0000005540)=""/221, 0xdd}, 0x6}, {{0x0, 0x0, &(0x7f0000005c80)=[{&(0x7f0000005640)=""/44, 0x2c}, {&(0x7f0000005680)=""/152, 0x98}, {0x0}, {&(0x7f00000058c0)=""/229, 0xe5}, {&(0x7f00000059c0)=""/57, 0x39}, {&(0x7f0000005a00)=""/208, 0xd0}, {&(0x7f0000005b00)=""/237, 0xed}, {&(0x7f0000005c00)=""/81, 0x51}], 0x8, &(0x7f0000005d40)=""/137, 0x89}}, {{0x0, 0x0, &(0x7f0000008100)=[{&(0x7f0000005e00)=""/57, 0x39}, {&(0x7f0000005e40)=""/228, 0xe4}, {&(0x7f0000005f40)=""/4096, 0x1000}, {&(0x7f0000007f40)=""/31, 0x1f}, {&(0x7f0000008000)=""/209, 0xd1}], 0x5}, 0x9}, {{&(0x7f0000008180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}}}, 0x80, &(0x7f00000084c0)=[{&(0x7f0000008200)=""/156, 0x9c}, {&(0x7f00000083c0)=""/26, 0x1a}, {&(0x7f0000008400)=""/183, 0xb7}], 0x3}, 0x9b}, {{&(0x7f0000008500)=@caif=@util, 0x80, &(0x7f0000009700)=[{&(0x7f0000008580)=""/3, 0x3}, {&(0x7f00000085c0)=""/233, 0xe9}, {&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/30, 0x1e}], 0x4, &(0x7f0000009740)=""/117, 0x75}}, {{&(0x7f00000097c0)=@pppol2tp, 0x80, &(0x7f0000009a40)=[{0x0}, {&(0x7f0000005800)=""/79, 0x4f}], 0x2, &(0x7f0000009a80)=""/74, 0x4a}, 0xd8c}, {{0x0, 0x0, 0x0, 0x0, &(0x7f000000c000)=""/133, 0x85}, 0x7fffffff}], 0x9, 0x100, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f00000002c0)="b87f326c8e9da80000c17b9854d2b21417aaaa520e25b73931801a108807e8b2d2eedafb8e761b0ca00c677192027ef2", 0x30}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x3}, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x5}, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000700)='nl80211\x00') io_setup(0x1, &(0x7f0000000300)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r5, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) creat(&(0x7f0000000240)='./bus\x00', 0x0) 21:56:08 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="11000000170244e0298ee0ffa034ff00070000009e0000f086c87697d11a7917"], 0x10) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r2) 21:56:08 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r1) 21:56:08 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00'}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) syz_mount_image$minix(&(0x7f0000000080)='minix\x00', &(0x7f0000000100)='./file0\x00', 0xfffffffffffffff7, 0x8, &(0x7f0000002740)=[{&(0x7f0000000640)="996fa754c0d803f282894b81be84c90b74284a13697b4dcfb51c5048cfb0e4b3c4a251b8a3fe5603a1a36dec9f232937ef413ab6082b47b9c8a4eb9d0e3649a9aaf716b834ccb58da600a55b4ce0f2d087a316902adb92016d829fb34f2a0bedb668d75bb87412f20faa914457bbe15b900f5cc25222ecf4e95b628c6e37dd0bfa34fbe831e51da6800a57b86ed8174edc3452c0c383e1e403ad40b94400c0d8ba4763e0176a8a5ca7355666a72dbfa2188ffdcbb1ad563f719aad29b17e74aa4ed2d6d5d47af16df671ba40dc8e31f6d04b600aaa23a359357e0f63c3b8831884166544862b902ad6fc1167b6406c3f15c15b2514b7a70475b8cb21ba051bbbad8a414f6a483d967d6f63c494fe34c207aaddf636a70de18bb91c6af0c3762978d18d74cb583c70a57441bbb64e93594ea2a2773b70ad06d87e7214b00f84347170a129565c67b83a0eb7713528cb2f70e4c12fd95a62425992f2429c62e21a3f31e07c8b919a70abf29391143c26744ec77014605ae1755b756590c96453406398051e2d14085c0231cbaa9737c4c1989677aaa6a4221cb1eacadef79839e3d0efbc80d24ea58c874d5b413e54b0f5c5eb2fbb2be7b85cffe89451c323bcd0397c7cc66a09d321536ff2952c4fb59c05f367614a46183b5ec81a2211496aca8ac3e2ddeca6800467e4c720587c37b5851246ebb2adec0cc22bcec37bcdeb169123e7125f4537c215febfb3d38cf3f6b63b005d5b0a55a4081071e2b794fed77e32697ae46cfcfcf68d990f893152d0b995ca8f2e48815129b71581d7f11d7e4c3c7d3fe329deab674f1130c519da3aadb8daa2391dde17e84662899f4d88649f18398208dd4ce4cba413b0c6666d564389444af7d960508cfb3a6241f8efeb179f7f1413b75e8318c96105b4f29c43829e4e0e4a75ced101eecfdae0e1e06eb8ae4fac765c32c81d574616bfe969c087e67fe75c654f130e2600aa6b4941675d9d46e72f3edac806912ceb0da57e4ddf963ecee857fdbd7cb6fc60cc095bafd000dc994667ed9845b68189fa299846fedd83a561ce8a83b1a89d0b211954f2fce8f35e563d0a9342189275f13b7003a58fef98bfb584a95dc3277131483741c88d11d5d74c784c16c2504d70e98ace22df3c139d87c5327b05f15dc80c49d6e61ed950babf72584d3a1ecbc243313340a76291f68b2e53643271cb36e0d587c4ef0845eb76b45b874c0bf688d30f8f0f7c0e702a16bfd89de80f04743d8fe627d1fd10a2334a06c5cdb7f0b1d5523d8dba16ba85c0be37018bdd121439260db324c7a46bb22d09dfb8600402ab1050527ade2806d99e8b5b0f99e278a104a8f268620a78f6d5fb06a1b714e692be8f2eceb1a74211b3353d6c22f55060e6e2e5e5b56ce3f1b400ef4860949891cbf34548ab823d68849f830f957822340c6835bb5d56f4075a12d10de9db60d20e1add2ba41f450f990a7bd76a5699ae0caa7f225559a293d6d819505853c1e6e43c3530ee5b1bf088d61530e46297dab3159105bd29ba1d8c2d1642264ad900c1cee92c098cfea7cc34841cfd9a99ad59c35628bac1d72e4d435123e5445829d78cc2c44c6350401bbc6cf82ec28a86ab8ec179f6f2dc2713b56537f89835c60e487bf1602c59248473bdda4f8ee2cf549f7a0bf9fae4636c258613bca22bee73d3c68dc701c249ca15504142ff518a10af688bfce70653be6a306ec06048e6f7483137b25ae4d94762f74004f80dd67dd62faee2c45fa194ccff9f71d6e8eca3698133f4ffe1b1c2b5eebe22417578ff83a295f422de7031a1f6c92654628bf5934eb4a2b9bc441b6939d1b75525a1396bb72413d45d1fd7a09ca8c277fb18fbeb40bef13eb09f50538f15b1255d1d96b53d11c935c30989cd8d96badf8b2f21b2f215ab1ef745a13ed5b34e48632ef2beb7dd8b60c9093a0f4d1692efd60ab1ff5245c07a765bd7ab077995178d8f6b9f19d39a24b0c88c317ebd469eab1555ce6efe8d947aa1598ebb5694c0a57f9df56654421beccb7dd2addca611d114029447dc9df08612b6d058f7dff283017637c3ced3b27877a551625b38cad3611a202c77fb27fdc52b5c523f73349ed8cc1f192f47558e2edf0c30ae31b6ce60140b90466967851dd99657ddb1850f0ffa578d49d85fb20fbba26e4fc325ed86c952fe81bdfafb7dfc8cb090ab9ff66734e8fbb1bf1ab0923f210bf0e69ee7e431683968cc56e51155150dbe9e13d7e2fbe1d1f52bd42f64a0409bf0aa49b62811dbfde893079e47a80cdd220edc149797566d506c9f265257724bbe8fae1a7148d0ea5bfdd06f6313b6e6b76c2b9de2b43121a79f630d4d34f0fb5fcc56fe72cca0d0082fb614389fa162631fde795f2ae7d32b2747b206cf70d0e2a06ec0674e872270e040c2b80001efab7640bf2ad758bc019d741ed45608f43e3c371c5b8d39fc0f3223f29333124a901ec3507eefdc992369d84e107a90934ad8a8fbac204711795ca07913a29ce7803c148522008e178a404ecaf1425faa1480dd7482e3c0e5544b9ba97c240be4b04e15affe3632defb68c34db9e82cfb70f1f486edaf661fae0ba4f3f8f436620fe9f47465ba60161c2c2bf77ade55b57e9486ff7b4b7c15c5f50d86f21a8fffbe311fc1b6acb371f10a7277cfe99fd5047671680a2be60b0f0928e441bb90440314b45054ddfff5fe2f5af04703af5ea92e684499cef4ef12e54f035ea0c306ac842973942809b1993df2bf9d062c371c43ab0d9a111dfd7e4a1f8c5344a4231f2a049cb3260665add1aa4afdc84e18819a4c4a7029299e7d7b14d0f67f5d818955cac787faa60d9634e3eb7fc5b2cf912fcad9a54c5dda26b7e47aa79e36e7280b7e2898a2879c5395486cf7e650788e910d2887b7476bb47ac76081c19a57890604dfeabaa68eb806c3124ece86671d7a2176ca1e62a9da22658978153b6c6ea58fcc520dc89566039ad2d30425e594c6b75588704ba68084b148d01035326704a396f9d2d8c6ed24a71c419488dec2e31fa68a09aa342eec06f0735c9a3080a36dd89cf22797cb2ababa2362c6812aa1fb9881bc1767c154156b465c116efcbc064a3f7a9fea1be715b4a39f3bb3b0f53a51857025f245a1dc3a68aae34f46f85742a5f17f6d691d7072e4c69063b2cd4575e4831062627e400e5db3ae0685ad382ffea14bd13de0896105e77abd4ee0533d9327cbaf3c4c491b8b202716ef6fa829038d1f89026e6aea49176f188896cbe57720c4f87d9457016df8d5fbefce513800e074490929999bb78ab6d994c0225f6c24b7b6c1dbf9574661181785e0cba065a6b78613b370760309a9864417a03cec9a1e42f2077dad756feca521a84bda551787d5e7ce4fa38b30ba4ab344792679b9b72d1189ce24414d79392cd7931ddcbce7a59cf239bfd9a0570b21742a5a870211d5a36f1eb2af5ac4d66a1f156053e1d33394ed4c8f499c128f0283bb8195bc8f65e0286d07cf329ef9e5d0b6f1fd38e117fdb819ac23077fe7c6b860626e8bfd8e779202b12e740a9377671d9953e4780e91bc6f88120d115835edf2d1fdf3915db78de3e801c9ee26417754e7659dd965ed2f0ce621b85843599a7c433b208a9ed322fabe2fee3b8e438c327f0b7d8572c928de54c9bb1157963c18c1622a7ef1c51dfa8f1a150b402e5f88aa5a13314eeaa4c7781cf831a94650b971edc381de3df72d18153af0d191c23f39df743672d73a747493c5e87a372ed1d2919d823c4fae2fd06526884450b72364e120486f33d49b1cf2c8b496b34e4e5d3b3e65c2c7027bb2d5140cc6b0b1407c68509878d93d42f1b7d53f589c22749ed19e8854b846351da07fce7994a619b5546e827d8a8744af9b581060dd047641faa76d0f0303a98d08bd37008b3390fd549522c8b9324c2613f5f5353473009f566a4c3a63a728b6e5237b0e143b38314c9cdeac44cc4186873d7d9e1b7cc9d9578a8f1f06c969749105079f3cb1dd2135ba8ef4bc4394de84c051ee5c880217021cdfe7f00a363c0878c29604ce6b1763adfbbbd24f7e007794d25921819c1bd225c26d9a33c05299440f2019ef7abdfe0d4c844ca8e27730845279685da8b659a36cb4072f3be16d69c0d7498867d2b305e78b66e849e75a1bff1d047316908898d60a4a2d2ce17e0bdf3a777feeb404f3c5787538797fbb7e9b51dd50ee2d1687928a8057ebb760a47a6101e8fdcab55874702207eac14e5bc982be0dcd936f0b9b940758ac85fc15913d38702253fde24d0a023dc3822d60c85974b58e18ff656bc538d7e4fc81d8cb60554ad453812a9ee027b0367252f7b27e91d0bdcdeedc01bed4b2d311b92537636fd26dc61238a28dd720758c7c10eccd579d134cad33490686bef5c3538f53c9567a2256fb7b2b71a45f93484a19d0f784f6a0680af50bb249b63780c965ba14d1756901b9ab8baf9ca61ae10af28868bb9533b6de88ab1fa6476611656b1396069bdcb434de1536dce684059d7fc05714614ac9fc31f7aca8617864fc665b2d7d8d1d70a3b9e6c1ae12a548daafb5268a30f0dc7785d20370a3518eb9ac502c141d89cda24dfa69c4f4cb7f7d491eb190d2ba8e683795c31f52d74fe7d79f1a39e172aeb3b87bce68a2759f4db1ab458b86cd5d9163a4150c7ef099973a27780bb532f66898de45037ac89cd1c0306883cae8a5f2097e57275dcdd7f221704725aa86113b715a8b4619616f69c9861467e613686e7f48a69181ad7e49b4107800e89a67e2cffb0238d3e408b849c4883d561979c047b68e18cc15786bc627e533bd28ed05e9a24f7e8b3cbebd4604d6909a4fc18c49cb9179061babe71291c41a99b768706c7c67633b26ead1b75a701f08b2dfd013c6064112238c7d5f16c4267f79ae77f7edc9fb2761eff8cfc07caf19a8ef96662781f46e643f8de9d0ce1505eeefe9c3091fab521a81130c26b989bcd4e3710e01019800d539e83e21683af7a46e944fc2fcac6939326ae7f5a48d4f72fa4789c2c5fc9584f3aa2ceb22c47a3ad15057dc1a4d85feab18328c04c9f9e3487dfa225e9cee3129404c22315081949efe667aa05e111e1c32bba32e55f23df51dd60561e3f29e5e84fa06be848939114abb894be35403dbdf120d852e8e019acd4e9534d91dcf65e083aa19d211aa9aa35f28dd3e4f3e676f1e45b9b6f08b16c906a77701529cf6e4f4a973a9fe6162f92ed6a3b2ee9297bbd3dfe9622de5649bba73032558fe79792581b0ea425eae5bfb846a65d45b6da64e579abbc7e884a382aa367f33a82a55b3e391f2191b629b2116c4280f506f3115528c6448bbcc7794e3b066116380ed27a32c54667008c18745dde81d0673b8a89535c985c1a19f8cfb6b5d25cd3699c6157231aac015b42e4a71d7a2dd5fa25f527653b556b257235a4cbe9e14b858685ea02252c785967764e752686eae725ffeb2040b10fdd5942a99f2366005f3d1d6dc10c7a1f1ad98a56e035891ec0f303f924551e7cb75efd196c9d3ee9b15068b183b60846a32ac9399aea2b9a12611ec2ee3bbb69da421b6503a0c263089e0666a633c02c7882492ed9063c105c06a081159bc66cfe142d467245f6ddc4bcc4ce0d2fc95c83497bcabd60a61b6c33eadbe0704bb1ff6118a9d367b4cc734ce348a58e4b4ed6d45d128c1bcf16571598a742c42daa7ab66b38fca43ba3781c3d96c251bb12c39f4fb47eb8dfb35374797c2350746411c888e87f00ba984d3ce6dbbb4433338988d55", 0x1000, 0x1}, {&(0x7f00000001c0)="43c48bd999567bdcaf3fe03ce16b49732e687c41a43f766042059fd82027c47f22e85df63539949779fde828a156ec93c738a9a979a44c9890d7022c68cbece876632c82c2e87b705ea103884c3b18fb52040c80233822510a", 0x59, 0xc7}, {&(0x7f0000000240)="121ea90265550a3088e0cbfaed48423daf7859b5031ec21561592859ec2c0ebb5ca1311f9e8d8576e02fc24600c6298d9b92ceb08b6b8db8bc283a4cef59517a6ed3966316cacb96c8a66f423a6d5780cfb29e5e", 0x54, 0x9}, {&(0x7f0000000340)="bce67987ea7be3fa7ef414bcd37b5eb2d65a1bcc33738da4d4d58109657e5ddb760b61ac3b9a0b804de6acf7219fea07755bb8f8820493b5a13ca1f2f35b4b7950d22a6929829cc7d6bb42c3d52a3ae96a79e9eb36dea73c357891a1d84e31ac13809bff92b0370e1cd45910a91603580d4e68ab764fcefff7c1da75621aee9b5aff82c891bd6b4a19304803edfccf620292025ba70eed987617c5e23643e1e7ee9b6b72a6b963327a5b7c9ec8bd3080d86f2c422ca7daa43f7ac93d5c98f68f3e59ebfa4749bf752f492eb8b44bc25f1c2ac2081f83fe93dfb743fb89cf711bd1763f", 0xe3, 0xfff}, {&(0x7f0000000140)='W', 0x1, 0x1ff}, {&(0x7f00000004c0)="f33dc90fa9637a3981479653279c3b3c864f4380366e2ad613a66c9c4ce3eb267eaa83a287024c373d637341632c26f0d95c8616aae92dc5eb3a264258417f3830d3b5e5a357ce2b01a0cab30876ff86bfb3abb3c73e296fa813ae1e06b4c10d3789341c8d6b85921ca05ac3035e1878b84ee79b2b216b1b09682ed65a0824ae61634810cfa0fc3612389055e62ae07d950f1c7f4f61666ec4726e286c3e7dd4f0a4e3a6863f96ac1195685bd5c6e781a8441453c605c272254c3161c9d4eee85ea3a8db9d813da0dd5745579115a023dd1338d6f4c625853a4c", 0xc5, 0x200}, {&(0x7f0000001640)="c7d905bbe1b48d4c05a02635a245e60e5015e5fe111bad34cdc94466ef02bb8095aa7b1d1f0bb191f35dce84ab83f6a21e19d9eb5a047b35de96644bb3953b5362424bd083ff6c9298ab08408d589d481028fde27bf98363396af0c8b9be8ae8f1a362a6550038297f94d2b052cf93e97fb03920749a43db380b8946b2251e33caa2902b9e5265f927a6f130a508b67e49d861e7e445f2fb769037d1a51d8d2469a4919fc9f67f748f8395a2302eaf4af508f140e63d8894484d682f7433364cbd", 0xc1, 0x5}, {&(0x7f0000001740)="999295c1199cc75f256a5c6ad0957c0f52470ba58ebdddbca5f49e54f31e38cccc615c8426f67a7702ec479840f9eba6ad0307646e23d5d4124c56e11421944cfe9ab2e1103adc940acac6018a44b61f4e604834223abcfdd4324b29e0f90a499f3f70fec9227d16fc3372394d9fe320be358a765e4fc3706c5c7672e2e942d520d9ddad0a29c584811af79692e21b9755a1ca8b3e2038558c0cb1cd5496cbfaa393dacf4b17012a44f2faee5119508aa3f121ada49098a393e22b73a1bc309702d446c5cc01689e6938cd663e45bf01450a9117ae4f8b59054c25982447b8335ea2b727ab02a3a3cf52d2568b031dc2ccd102ced303e394ed4dd71c4287083b9cbf4deeee27deea13fc9bb265c596334c4e53a3f8a3d1e3ec91f0ee8671f04013b15f835edca478e8c760ba5d5c4c0f26d5860ae6893f8b47a3e97daa7989408dd7e385fa7d3f552374b2c4a5878fbdb83c1787d2b41d831b4961721320ac12f51547c9dc664e0fc4d9f4be4e2c2a6c13732d585c6ccb59b47e711317a5e43bb2d3d5ad5371889a653381fbad2e6514f6457ecd716eeb8c5d86d5d84a202e21387bd66dd1252e886b720bc2e902ca98c4e8f9c9d2069896d4c0101afa02ab43e77275cd319b33b7bc6dce85771df10f2d6720fa5b0754cbe0b5095065abd857ad4d4a1f704c989c81022ea192a8abf29e4f6b71e635ea954731f92856c32c9c579f82559d66ed6245276d4bb7856241472605ff130d5aa98ca4273a05cbbebdd93d7ef8abaf211bbc4d79d433786c66d04a8204a1eb010d1d796629b1ddd1dc92bc78b63895d4349338e4cfbb320ed28ef50657b830cafcc7663164adbacd294f4efd31249a1443ed77b332088f30ff5900bad686b922f403632de8dd87f8f7cd6ff8534fd6e4ce46fb16b20c024c913eba3843d129469be6bb14961c417b63afa9278e084d03f5572488601c01407c8280aff8a78d2202bbb79bebbcf44b6ad834e6c2ec501d94ca47f95eb9dd23697971e8d41cf40ca01333dfb06ebaf312e80a152a24208cd5e6d84b9b3381422df978d9893fa8a225a832d083385da24f85781fb688e7602f8742204a42a64dd08e784d27e636098045709a0f07e81c65168eebd1017cacc4e25a0a667fc4cd04c86b552d4836082667e2e69d1cebaccb0988722d07448ed060f0cff12dcea09eae958a4bba1c2ac1816a552657c46eaa92dce4f57f971bddf86219972943ed1977a3f1f6d4f57e00d5de663aa3f9cf43b0b98418b22a320abb641d8a442a961fcd5379dfdd8f612b712f79c02c9643d968213f32c1107e6a0f9980ba1eacff33a0c631fa4226d01e3fb8979b81c9133591ca498c5ff69de7dcaf75ea17e6605fde068d422fb8a9d1123c5a10039d19d63c4f1f3c46a58f71d3952f8cdfd4cfea5766d886990fadea5cbcb096bc62a27aa9d0e5aaae6e310d97b4f5b98503f667377e42f2bd207e35ef985c1a4dedea354203457ec21aeec6ed14f5122df9f749cc368946d955488d79ebab7011581c7a52138bc57ae1d28a2996837845c8dd4a1b75f95863f1d9d601591825b4596bf73d30eb28b2a77f6fe9efb60cabb906b5d197dcf803da40a881209d1e62e800c757f69c9da5f6103b4e4eb399b31060a08e33be2503b4384f83228dcf68150729db450ab275b2c3f56456fe35f33a69d1cf6f79f8638b0d45d141fd2d74ebd54f829df85594566abe96f2eaa02bb1c96c364ca0d04581eaa14a0997537210de2eced75add191386efcd29ee6613502e57907593f1658c41752de72c4cce5a387e937ef5e1d39c05040ee41dcd98fdde24fb59c98c38d171ecc4339fb1aed06ece9c1e412f42dab5487ce9f615f8705664a72bd76273ceba02facdc564cd200be054e161ad67652b2e65c587def2538615f32b9cca6e1c067bbdfa19bbd6e81763c33b2b8240c320611822a45bcc022af9708b57d25fbb28c5df84febef4c81e1c44bc69dd74af9e22028c861de22fecc933ad23e4d3ae1d771d35eccf855fdb6a280061c56a9284993f5213ba9d08b3b5bf6691c4cf9f744560b97c55f962e5fbaeb364f9907e6905a8ead8277062054df27494cd4a1357409dfc2d8e99faf57926bb6453fb778ca6056894dc7d0830ab8248b6386c7a3ff81f47e91bfd562a9779d0a85401e3f7510eaea24af8cd8ed845c5783707a4bb44bda6809e97ab3370ee44e52883d5b84d9c3a1eb7980f2f4cd5296070e7ecacc884d6fafab2114693b3c7671d0802408d972959a4399c0a63472d67fabd144f87ea165c434094ce2fe5d8d64a39a0299e2fb2b49ebfcc504fe1052de8a3bef810fa743cf148b7386cfdb60a1aec4d8216d9d5962bb7eb12ea53cd034333bd3d180dadfd9775ffaa3edcbe739dc6a638460da0ad319763aaf7df2259c4b7446886f25877c8140800f1e5aa8f436c4e0f5d3416c5280fff17b6938aab67d3d026eb2645083b0f712a5c438f1239c35b4ea68e5096e09ef99a83ade4e0680733c710c89337fcf284320bf08dfb2cea2f6fa34e1d7cdd556628f906f3c90be00e28c8920cdb1735ce1d11763d1a0d8e72635137a846ab50601869bc8f142aaa6d770356348e90c8773dfe242f077a836edc79f1733d0d4ae169d70847b8ccaa49786d75c47528ff711b9ee13c0e3b96c2195e6c07e3f4401fb9c989ae650e1baa8ceed2cf64626f2d9bec6d223470c2580775f9f08a35629e1bdf97d4187de8a74f7ce39e3a634bc2cc66ccb47b6aa95eeba2dd948befebfb149d697889e1b9cc22f540265c831aafc66e320aa49988d7a681a897b344cb3f02707c3d7deeff9513eee133d4baf02e1c5c73fc68201772f32878ac62eb6bfb3a5d096673e5e8e0d26bdb7b1f1b407a63c3830eaa4bfb8bcc0663dc4ed505a53af1728151cacb5e75cf5dca73763f3b62d6ac6aec598a4a14d0b26b334c793a1c0f860a0a6520e6b2014e6436e0a645d93e2521e20fa236147c6ceb100b99f822c047da6773f4c366fbc1db8e3b637478e3a8b09cb9b0a19a871b180e6ef68e4a61635a7416df5106d605eda67a9f7490a80e6ed7e8e4d4f72928f086fd719f7a7016ce931c5d6f208c4cf3ea3d47a932cfa6fff221802935e7a63d4374005626139333af387ff9e5d6b939d8cc84b92bfa7540c3c281e36a51a8f4c51c506afea77360f3475881e8a0f6e588fcfb03abff2686576a3b81abecc4785e8ca60219702977409bdd548a01d67544d8ea1539161b7c043a8c2027e00c89acb77eea7142e5dcd261906311bf5fdba562de05971f9c01c5be18dabbaae623f3837657f1f56158d2c029b0353a16bba642bea3975f9e9844cec16e8c4151e444d4d941c986230589e9436947dc0fa4e80290cb04134d420651a36467b5193db8e4a28c6d7fd671bc7cc8d96a2d93f72f433d13a0c19f7e68038843a33d7e4b99f7dbb7de4d37229981565cd84e5db6814f74af9d9ea01d48168a3ae812ff8a01341eb0803b165fcc9d6af996abab1b6543e61cf40750a26e46fa985752de9d2d19ec3d83b5a9db4edf6c0ed13c200c573449ec576ccaa8d0b6a05ff6e291801bea9b16e343d43f0440118bfe8e8bffdcaa4f7269e524a4e2e9f9c9f76796626430d4ffb2a38fa45ebe06ae166807690dc7664558a34d8a765a3936e5ba56131f70a2e076145c19f0c4532cc99dddbbdde3b292b365f2ca78ea321dd9aee779a7113df801a1c6127e2caf93da68bc7100844f3d054c95cd5184751070aab85d79eda8cbbd77959f0cd2b01834c4808db3f81f04631aeac3ca46c7dda91c98c644a87e592326cbaae488e93b44f2a1b42b3f3db5f6036e1a323cb86ad845396ec21a479670e47907913ddaf135a9ed8ec565a9979428ecb2187c3f0580b2c3b98a5bd1307d5862c4b84e97006e5d3f8518cd8d7ce6912480c333b46437fa2da709c8d3c35c6d3b5dc42e25c1eb43d67bbd6293cde68a42c76085694772a4ccce73dc017585fd19d4dc61e2df9fb0a16e2ee9e900f928e35367e0a17100bf5dcd855d3264eccc0341d1cedb21d7db9fdf101a744ddf9d9bb4832c45ff198e163c4783e6cb02dddc3265553ebc1eaf232c519227770f1c1ecb4c0b4dd674e7f169287f6fc080ea29672ee1e886d0d0865ec057f340ea59795a5e25ad6bc31ae77311294f11f9c572bc83f4f7fd18c0d83e09024c15b8c2be1078a5f7767c96d6e6890581063c1909f80376a5ff46e8e9217153e64caabd277f5934a141a64fe7a67367f116166a99a82fe155a93214a9f2fdc76f71f11cd7cac741923b3eeda8d87cf3856bc91eb4bd011a8f8cb294b1aef67e777161fc8b83744f680ed3ebcdd7b0db131408fde90e64cb7efff21dc0311259f9f67cd59f871ad7f93a317e4dcf881b276cb5a2043232d4ee73ae20cbb401ce4989d1b775d4f7722ed203695bbacaab315791b3dca0f495b7448ea48df2e796f54fb12781be1b5f1e3624b411885c2591da1a9fc17c8953b9643f7c50ff308fc4c864ce75a0c26718cd4027e4a5ce623769544772691fb2527609a0d6c556c3bc0377ec8feaa7b611d1abff39805046fb4db67fd53d3c2839d2de3907d76bd8438653d1e65a7d788616aaff46630f191ea3c3405d3352094dd50526dd9a9e926c5531002e64eff7beffc6cadbed9b7b219298bdc6bc53b17cd72ddfa2d418baa87b6f3838e6fab98468d1ec0273c93e15e856da041cc14e409eb8c17a933c5973a73df4af028ba3d1ffb2b5d64a8de38a764edf9a57d6b2d768977103659d16970dfed922c866e738256ddcc8d57dd592a6f70c1539021d331a15dae4181d5e7817e1d47a3d255ddc29e85a7301cfe80b7b4ccafb5e20fe3ebee7c623407146258b03fef3285c2bc5b9239d49d65d62f4b194680f476e9e88f0a9e006f4bf43b01706f0fbf69565b26b051fdd1d493d8fbfe0531ef440e5723081ce2b8a1277be0b6ad54a22488affaeb9d0a23056da99c3717d38153c65ff56e6305d07bb025a09fc3c9abc59ff7510f0ed9aeec4eda4651aa3bdb158e7f4d7bf9e09e4f0e791d95457cd3f624a28f96d04c62bda99c1e49578303b5da0b9cb51bb0e73c7af8bbfa67d5a5d516290e7ed9f67edfb2e708912d79ddfe3e04d03135ca8d312fc557c9326a9629868ed1555404a80592282612bb29724e2f573ebba1e8abf53f547f3a3829089896a2b0605e3b195f430728114cae3df09a45dcf46a98c855bc8de8851eb5216351938703c3496ab5b98b2db2e073125fc4b9e73daef514ba5a6ecc568093c06b99c718c59049bd09ff19b42cae390ef8c4ca940109212c4b33f8c41e762123a545f1c97e4935788b0a451d9ab2b51d37501ee3e2a0acfd3bf1aa2fd91e61dfb7c5533407dcad52c6af26caf516fa5ba6eab767eb1c6b3f0b281f11b51a98e64676ab89fd6f81f592bec35485929940a679b1d073375db31041d2015b57cd2adb4e3b663cb981e1d8de6524eff03b1ad669e38950dcb3a05806783a28a403b8dd7a2e013ceee4a434f338eee395ae2fc1414401bf5f714623a019ef199639991de675e45d7bd9254fe69dd9ecea79f51d8c908e3c78076eeef68d7b076c4cc6e83daa30f851df31969e53f2d67eb4329c80d82cfe13f9a33c2f3a5b1b450cf970c35700b50a3c5ce20374de3d17d433f23ecb787663e1db82f18087d164521b64d6975929b8394e1acbfbad90ce3c13238921d035e08d3c8ced62f54d79e54aefe3bbb11db73e02d36b4cc3766a02d8c990545dc2084be95701b0a739f4d", 0x1000, 0xfffffffffffffe6d}], 0x4000, 0x0) 21:56:08 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000140), 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000700)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000180)="f6ea32bb284b2e51703835fd944afdf4f46cd02ebf501fc0fb7dbb5f54e28164ae82a5de9291ad7cd17b3dc0b9e93e7c3e28d6bd925db07cfcd68ad99f", 0x3d, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x3, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140)={r3, 0x1}, 0x8) r4 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000240)="1a", 0x1, 0xfffffffffffffffd) r5 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc6, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc6, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r4, r5, r6}, &(0x7f0000000040)=""/18, 0x12, &(0x7f0000000180)={&(0x7f00000000c0)={'sha1-ssse3\x00'}}) [ 2472.198720] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device loop5. 21:56:08 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r1) 21:56:08 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ttyS3\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = dup3(0xffffffffffffffff, r1, 0x80000) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f0000000000)=0x4, 0x4) ioctl$TIOCGSID(r0, 0x802c542a, &(0x7f00000001c0)) 21:56:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) [ 2472.381254] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device loop5. [ 2472.458361] sd 0:0:1:0: [sg0] tag#2986 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2472.467216] sd 0:0:1:0: [sg0] tag#2986 CDB: Read Block Limits [ 2472.473366] sd 0:0:1:0: [sg0] tag#2986 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2472.482457] sd 0:0:1:0: [sg0] tag#2986 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2472.491439] sd 0:0:1:0: [sg0] tag#2986 CDB[20]: 9c 09 3f f0 09 21:56:08 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = creat(&(0x7f0000000240)='./bus\x00', 0xa6) recvmsg$can_bcm(r0, &(0x7f00000005c0)={&(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000700)=""/138, 0x8a}, {&(0x7f00000007c0)=""/227, 0xe3}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/12, 0xc}, {&(0x7f00000018c0)=""/162, 0xa2}, {&(0x7f0000001980)=""/91, 0x5b}, {&(0x7f0000001a00)=""/204, 0xcc}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x8}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r1) 21:56:08 executing program 4: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_ifreq(r0, 0x8937, &(0x7f0000000040)={'syzkaller1\x00', @ifru_ivalue=0x2}) socketpair(0x28, 0x1, 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KDDELIO(r1, 0x4b35, 0x3) pwrite64(r0, &(0x7f0000000180)="7f48b77311feab67fb108fac16a65b13a8b80842d85ea4b71b593f921538c66e6bc95a7730bc559db61a82f510f6e9ed54d6f68d3c3f88ae932bb7e4b76c2c32dcef78da2a7f6c", 0x47, 0x1) r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) close(r2) 21:56:08 executing program 5: io_setup(0x8dfe, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f0000000000)={0x4, 0x1, 0x0, [{0x41, 0x9, 0x6, 0x0, 0x5, 0x6}]}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:09 executing program 0: io_setup(0x1, &(0x7f0000000300)) creat(&(0x7f0000000240)='./bus\x00', 0xa6) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r0) 21:56:09 executing program 4: r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) syz_mount_image$btrfs(0x0, &(0x7f0000000140)='./bus\x00', 0x0, 0x1, &(0x7f0000000180)=[{0x0}], 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="73706163e55f63da2111473d76322c0000766963653d2e2f6275732c73706163655f63616368653d76312c6e6f7373642c6d657461646a74615f726174696f3d30783030a50030302c7065726d6f1e3478696f6d743d2c6d61736b3d5e5d41595f455845432c646e745f6861736828000000000000000000000000000000000926f531a759bd1884cf438ef2f34447d376e150b9c677c90c71e4bfc8cd2c3941002f085198b5257b8a5391a19927e8a3f871df996d280629ee1550213083c14b115e3c2c8a4ce45ec7fb326d308d63a8208710f8de9b3e90c9c75028988c6887ead4713a5849684b8826d27984a28fe076348e8ce833dced110f6fc7d6ef6b049be217dedcbcc3e683bbbc2d754d15f08f8671", @ANYBLOB="ec7e1735ff538b1a4ce41bb1e39f7204f42179f27ded8e52632608116833851baec0b2d98ee8b739362eb6432c9baa5b79db234e9fd9cdf14252438171b06bc8d05abd483aef17f39d47f32fd6f1666cbcf1b4383451fea0f8581ad4c173f9dbed9e29040072af6238e00600a34fcd2a3be8a6b85dedc33f099116e12d86dcaaaa8ce6d8f07a109bb0ee943737dd22628f579af1564739f876ab2a08dfd028f8785c80751598ef55f65c3256cbea3d2d5d95730dcf23e5500e65bb1dbe8264a9711a1b77ed85653658bbee7eaaf8de3ffaddf63e362a9dd5394e81fb710727254a17ea10a383286a2b34c89505c9b7b5"]) syz_init_net_socket$nfc_raw(0x27, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c) ftruncate(0xffffffffffffffff, 0x208200) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x1000f3) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wg1\x00'}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003200)=[{{&(0x7f00000012c0)={0x2, 0x0, @rand_addr=0x40}, 0x10, 0x0}}], 0x0, 0x804) ftruncate(0xffffffffffffffff, 0x8200) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x294ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, @perf_config_ext={0x1000, 0x4}, 0x8000, 0xdf, 0x0, 0x0, 0x0, 0x74a3be8f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0xa0) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x0, 0x4) syz_genetlink_get_family_id$SEG6(&(0x7f0000000280)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYRES32, @ANYBLOB="0000000000000001000000000500060000000000000000000000000087c704d4e3e3441c83720fa28266b7926e00000000000000000000009962b46473c68409d2cdd99df0ca52a4801868ac053681618eb6930b690d10d720a81bd3c31c3c904422574ab9c565e806078d5461ebdfc12ff29d3c2f7103186914fd445c914e9f8260dfbac1d0f7a59e981bd0d94c6a652f3db7a11f6f03f32e35a511df1c41f1351569daf8bca4985479e574b195ff592f9a8d2fdc123a4171eb9d9b143434ed92461c66869ccfcb51653a302dcafd35b30751ff3de4909e735f0a29d6f1241915a4b596d3e44d00df3bc46fb20978af7ae31dc755e4ac073c0c240f71086e921ed5618a52af439fbddd0fd7a5f945adc32b0751a79ae948e2ce56370de7b431bed6ea03cdde9c5008304199a8c6dcde2f6a65325a3041c21794e2ef9c7de9fbc1833f4ebb9a37d2ef8800000000000000"], 0x30}, 0x1, 0x6c}, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) 21:56:09 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040)}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000040)=r7) r8 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r8, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000}}, 0xa0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r2, 0xc0406619, &(0x7f0000000000)={{0x2, 0x0, @reserved="655bb033edd835da6f434b3d04e55a3bc8073b02b88303893817f420ba507aa5"}}) 21:56:09 executing program 0: io_setup(0x1, &(0x7f0000000300)) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r0) 21:56:09 executing program 2: unshare(0x40600) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000002c0)) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fd, &(0x7f0000000240)="ec9bd1dacbf55be2f9757e8189540949329da7956c6294634626e268") r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xf17) unshare(0x40040400) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000540)) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="40b3f8cf8ca28516da76329a9805002d502460021100fc00006e", @ANYRES16=0x0, @ANYRES32=r0], 0x3}}, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x77) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc00}, 0x26000880) epoll_create(0xfffffeff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00007a8000)={0x11}) getdents64(0xffffffffffffffff, &(0x7f00000002c0)=""/212, 0xd4) ioctl$SNDRV_CTL_IOCTL_PVERSION(0xffffffffffffffff, 0x80045500, &(0x7f0000000040)) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000000c0)) inotify_rm_watch(0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) 21:56:09 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x278603, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r1) setregid(0x0, 0x0) getgroups(0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x102800) write(r3, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0x7) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0xba) dup3(r3, r2, 0x0) preadv(r2, &(0x7f00000000c0)=[{&(0x7f00000001c0)=""/228, 0xe4}, {&(0x7f0000000000)=""/27, 0x1b}, {&(0x7f0000000340)=""/174, 0xae}], 0x3, 0x3f) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r0, r5, 0x0, 0x4000000000010046) 21:56:09 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x2, 0x0) close(r0) [ 2473.259264] IPVS: ftp: loaded support on port[0] = 21 21:56:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) 21:56:09 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:09 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x2, 0x0) close(r0) 21:56:09 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xffffffffffffffff}}, 0xa0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="2488c64c1506be0ccf3e01022e75eca8b6ddbb6f05984ea0e6000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x200080d4) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000000)={0x4, 0x0, [{0xd, 0x6, 0x2, 0x400, 0x4, 0x5, 0x1}, {0x80000008, 0x4, 0x4, 0xf75, 0x266, 0x40, 0x716fe442}, {0x80000001, 0x80, 0xed1502e57c906460, 0x0, 0x0, 0x101, 0x1f}, {0xd, 0x63036103, 0x0, 0x3, 0x2, 0xf2}]}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000180)={{0x5, 0x3}, 'port0\x00', 0xd, 0x10, 0x3f, 0x4, 0x6, 0x2, 0x55, 0x0, 0x1}) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000340)={'veth1_to_bond\x00', {0x2, 0x4e24, @local}}) r2 = syz_open_dev$radio(&(0x7f0000000380)='/dev/radio#\x00', 0x3, 0x2) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f00000003c0)={{r3}, 0x6b850628, 0xba93, 0x374e6fec}) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r5, 0x0, 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, r5}}, 0xa0) getsockopt$netrom_NETROM_T2(r4, 0x103, 0x2, &(0x7f00000002c0)=0x1, &(0x7f0000000300)=0x4) sendmmsg$inet6(r0, &(0x7f0000002a40)=[{{&(0x7f0000000100)={0xa, 0x4e24, 0x0, @loopback}, 0x1c, 0x0}}, {{&(0x7f0000000480)={0xa, 0x4e23, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000006001c0029000000370000010000000000000000"], 0x18}}], 0x2, 0x0) 21:56:09 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x2, 0x0) close(r0) 21:56:09 executing program 4: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x9}, 0x20) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000000100), 0xffffffffffffffa5) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000000)="4760ba189e151c970ff4001100002b3325fe8000000000000005baa68754ba00e8c1344f3e62d76c27e8000041020000000180", 0x33}], 0x1}, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x40000, 0x0) ioctl$VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000180)={0x9a, 0x8001}) 21:56:10 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x2, 0x0) close(r0) 21:56:10 executing program 4: r0 = epoll_create1(0x0) r1 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000280)={0x4000201f, 0x3f000002}) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet(0x2, 0xa, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], 0x4}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000100)={r4, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0]}) r5 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) close(r1) [ 2473.843710] IPVS: ftp: loaded support on port[0] = 21 21:56:11 executing program 2: unshare(0x40600) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000002c0)) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fd, &(0x7f0000000240)="ec9bd1dacbf55be2f9757e8189540949329da7956c6294634626e268") r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xf17) unshare(0x40040400) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000540)) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="40b3f8cf8ca28516da76329a9805002d502460021100fc00006e", @ANYRES16=0x0, @ANYRES32=r0], 0x3}}, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x77) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc00}, 0x26000880) epoll_create(0xfffffeff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00007a8000)={0x11}) getdents64(0xffffffffffffffff, &(0x7f00000002c0)=""/212, 0xd4) ioctl$SNDRV_CTL_IOCTL_PVERSION(0xffffffffffffffff, 0x80045500, &(0x7f0000000040)) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000000c0)) inotify_rm_watch(0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) 21:56:11 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f0000000500)={0xa0, 0x19, 0x0, {0x80}}, 0xa0) r3 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r3, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)={0x4c, r4, 0x400, 0x0, 0x0, {}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, @NL80211_ATTR_MAC={0xa, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}, 0x4c}}, 0x20040050) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f0000000640)=ANY=[@ANYBLOB="a543ecbf", @ANYRES16=r4, @ANYBLOB="000227bd7000ffdbdf25440000000301180060baad429628327ab00ecb0779888000ff90d74ea6538399449ce545c92d38ff39fed0a1fdcd90efca40a11561b68e412fe62364d0f1092d62042e3630834064abe454479cf5bd5eba69b8903ad114cc5c058ba78e685f47655765f0dff92d7a100c867666bc34f068f8595d6c81245c9c75d5a65de28f24967e4750c24b2862ff031bf9cd8e9f04301046975204745a39090e02bbae0170d27378fcc4c0c59faaf877b64889a38afef1ac0dfdfef29f1ad8fe1e54da84cbf441748096d49c6ef5dd96367d8c6bd50c4d5e2e7e63b72cf43ab4e04bbd018f413eec476d97541671b38643f1d52cfa7a329d3ed1a6cc51c0417cc2dd064e843fc3c14e47ea4c00d8025a803801020051000200ffc7f7e24765c7c8f889a7188129fa4d35c9ad2f52f75d36eb40f56155ee0167ee838dc49e0bf29e8370baf88b1e92180a9347d1b3c61758a3fa9ab644c8f399ff343ff462df451f711cb5dad20000003c00020069e6cf58a72162ab6be62f1e6e6ef87ac99d1d267197304ea7aeb74bf035ff2f827a22ebe3bec3ce997629ab1e6f3bf36f6e365f4752f2ea140003000600ff00db070500040001000900ff00210002006ba0222940cc75b284bb0253482b47702d8e0b4f99edfde8cfeebf062000000005000400030000003e000200509d6f3ce7a48477eab61a55b4b2e55e2d744e031e34f3f4b3eb6eb34d61c0bca1b0fb73359b052a2cf957bfbe166daaf997a5c053fdbea97f83000005000400010000001c000100620744e85582d9f43a37a8d19b6976a6a64d75e544b083157000030005000400020000001400010071b260464fb4afcdfcfb7a58e24ff37b140003000900010005007fffff03e3e000010010050004000000000005000400000000002a0002005c57b7c5e110c3f42606f6d1a96e0891aca8906b95a33fb4464c8c676d596f4e01558fe6bb2800007400000014000300000001000180ca0006000080040069261500020069fda024107e58ea6cd79ef34592c07ff7000000050004000000000014000300e0ff1ce80300040000802bdbe90e06000f0001000a0441ea6af495ef95798d000500040001000000050004000000000006000200143e00001800010014000300bf00000200080200060000080010a20c9000030005000400000000000a000100feafad4ef42a0000140003000600ff0f00000300ff00f7ff010001001500020086aacf43c2b7361f17de703916cc57898b0000000f000100e4a0a95c693a49591a3ed0000500040002000000050004000200000014000300000100006407000112000400000107001500010047833fa9152d50b6a7d60b420f3818f690000000100001000c0001001a480020d2eb8924"], 0x3f0}, 0x1, 0x0, 0x0, 0x6004040}, 0x44040) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SOUND_MIXER_WRITE_RECSRC(r1, 0xc0044dff, &(0x7f0000000100)=0x8482) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r5, &(0x7f0000000040), 0xff66}]) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$VIDIOC_G_FMT(r6, 0xc0d05604, &(0x7f0000000340)={0x8, @win={{0x8000, 0xa8, 0x4, 0xffff}, 0x2, 0x5, &(0x7f0000000080)={{0x2, 0x3, 0x6, 0x9}, &(0x7f0000000040)={{0x9, 0x4, 0x0, 0x1}}}, 0x0, &(0x7f00000001c0)="bb54083ccd3bdd4c867037aca83cb6ec28ac3b79307157a4f02356fc0b16537f90957e9176a89d4ee706d58f9addf921fb2181b2d22323ab81a5f66c5a99e27c0399e3f5958b2594dc6a9ca7660763485d771119e318594b584fe3becef8b921c6aa3126a21126f641149cc86f67dc2392260ba1034ef1900e7a5f09ffeaf2de979d7a8aca35087606a795a271abcc6dee593abbe6c0697a755c8b1f5ddddb5201dc8a34e7f66dccf2f1903914fe1756779948955c4a00de623f51ebff74debba97e81aba998e46c54d646138cf0c080fd3d8665388ef90b21e34e160e39", 0x81}}) 21:56:11 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) 21:56:11 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='erspan0\x00', 0xff89) connect$inet(r1, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7fffffff}, 0x10) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r3, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004b0084c0ed5ddd9a129da4b74506e9949477fb7ee9b10b120711a01eed2eccd4cd2fe318d420db7cad5dd27292a4c473935dd6c0001225364931f37fcb0f2f271032d2f85e0b2cf5fdee7979879367fcbc9e3988bc91115d8bca59fd55d60fba7810555e397ade303b2088942c4ca4f26b0ff07713e33f73b0bef1c230b8c5dbaba09be5bc3890"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYRESOCT, @ANYRES32=r3, @ANYBLOB="f3ff0000000000000800000009000101727376700000000004000200"], 0x34}, 0x1, 0x0, 0x0, 0x811}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in=@private=0xa010100, @in6=@private0, 0x4e22, 0xa9f6, 0x4e21, 0x5738, 0x2, 0x80, 0xa0, 0x0, r3, r5}, {0x101, 0x100, 0x3, 0xffffffffffffffff, 0x2, 0x9, 0xf2e, 0x8000}, {0xcfd, 0x7ff, 0x6, 0x1}, 0xfffff1fe, 0x6f6bba, 0x0, 0x0, 0x2}, {{@in6=@private1={0xfc, 0x1, [], 0x1}, 0x4d5, 0xff}, 0xa, @in6=@mcast2, 0x3503, 0x3, 0x3, 0x0, 0x3a6, 0x8, 0x4}}, 0xe8) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000080)={'IDLETIMER\x00'}, &(0x7f00000000c0)=0x1e) r6 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) splice(r0, &(0x7f0000000180)=0x9e3, r6, &(0x7f00000001c0)=0xffffffffffff0000, 0xb880, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x11, 0x4) sendmmsg(r1, &(0x7f0000007fc0), 0x400000000000075, 0x0) 21:56:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:11 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(0xffffffffffffffff) [ 2475.281848] selinux_nlmsg_perm: 385 callbacks suppressed [ 2475.281858] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 21:56:11 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(0xffffffffffffffff) [ 2475.358696] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 [ 2475.403157] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 [ 2475.432493] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 21:56:11 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(0xffffffffffffffff) 21:56:11 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='erspan0\x00', 0xff89) connect$inet(r1, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7fffffff}, 0x10) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r3, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004b0084c0ed5ddd9a129da4b74506e9949477fb7ee9b10b120711a01eed2eccd4cd2fe318d420db7cad5dd27292a4c473935dd6c0001225364931f37fcb0f2f271032d2f85e0b2cf5fdee7979879367fcbc9e3988bc91115d8bca59fd55d60fba7810555e397ade303b2088942c4ca4f26b0ff07713e33f73b0bef1c230b8c5dbaba09be5bc3890"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYRESOCT, @ANYRES32=r3, @ANYBLOB="f3ff0000000000000800000009000101727376700000000004000200"], 0x34}, 0x1, 0x0, 0x0, 0x811}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in=@private=0xa010100, @in6=@private0, 0x4e22, 0xa9f6, 0x4e21, 0x5738, 0x2, 0x80, 0xa0, 0x0, r3, r5}, {0x101, 0x100, 0x3, 0xffffffffffffffff, 0x2, 0x9, 0xf2e, 0x8000}, {0xcfd, 0x7ff, 0x6, 0x1}, 0xfffff1fe, 0x6f6bba, 0x0, 0x0, 0x2}, {{@in6=@private1={0xfc, 0x1, [], 0x1}, 0x4d5, 0xff}, 0xa, @in6=@mcast2, 0x3503, 0x3, 0x3, 0x0, 0x3a6, 0x8, 0x4}}, 0xe8) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000080)={'IDLETIMER\x00'}, &(0x7f00000000c0)=0x1e) r6 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) splice(r0, &(0x7f0000000180)=0x9e3, r6, &(0x7f00000001c0)=0xffffffffffff0000, 0xb880, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x11, 0x4) sendmmsg(r1, &(0x7f0000007fc0), 0x400000000000075, 0x0) [ 2475.468104] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 21:56:11 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x1a) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}}, 0xa0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000001c0)='highspeed\x00', 0xa) ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000140)={0x6, 0x5, &(0x7f0000000000)=[0x9, 0x918, 0xff, 0x8, 0x1], &(0x7f0000000040)=[0xf482, 0xe3, 0x5, 0xff01, 0x7f, 0x3ff, 0xffff, 0x200, 0x8307, 0x1f], &(0x7f0000000080)=[0x9], &(0x7f0000000100)=[0x9, 0xd2e, 0xd191]}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) [ 2475.535092] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 21:56:11 executing program 0 (fault-call:1 fault-nth:0): r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) [ 2475.625184] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 [ 2475.663918] skbuff: bad partial csum: csum=1023/65535 len=1024 [ 2475.718304] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 21:56:12 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x1a40, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)=0x0) syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x8001, 0xc0) capget(&(0x7f0000000180)={0x19980330, r1}, &(0x7f00000001c0)={0x40, 0x3, 0x7f1d, 0xfff, 0x2, 0x10000}) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x1407, 0x20, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x44084}, 0x20044008) close(r0) [ 2475.767664] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 [ 2475.792810] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16453 comm=syz-executor.3 [ 2475.851947] capability: warning: `syz-executor.0' uses 32-bit capabilities (legacy support in use) 21:56:12 executing program 2: unshare(0x40600) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000002c0)) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fd, &(0x7f0000000240)="ec9bd1dacbf55be2f9757e8189540949329da7956c6294634626e268") r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xf17) unshare(0x40040400) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000540)) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="40b3f8cf8ca28516da76329a9805002d502460021100fc00006e", @ANYRES16=0x0, @ANYRES32=r0], 0x3}}, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x77) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc00}, 0x26000880) epoll_create(0xfffffeff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00007a8000)={0x11}) getdents64(0xffffffffffffffff, &(0x7f00000002c0)=""/212, 0xd4) ioctl$SNDRV_CTL_IOCTL_PVERSION(0xffffffffffffffff, 0x80045500, &(0x7f0000000040)) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000000c0)) inotify_rm_watch(0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) 21:56:12 executing program 4: pipe(0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x446441, 0x0) close(r0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) 21:56:12 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0xffcf761c58bf0836, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}, 0xa0) io_setup(0x401, &(0x7f0000000200)) r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x7, 0xf8, 0x5, 0xb4, 0x0, 0xfffffffffffff133, 0x0, 0xa, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={&(0x7f0000000040), 0x18}, 0x0, 0x401, 0x1, 0x1, 0x3, 0x0, 0x118f}, 0xffffffffffffffff, 0x9, r2, 0x2) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000080)) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)=0x1) 21:56:12 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000000)={0x0, 0x2, 0x5, 0x80000001, 0xfffffffffffffeff, 0x34, 0xf8, 0x1, 0x5, 0x400, 0xffffffff, 0x1}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:12 executing program 4: pipe(0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x446441, 0x0) close(r0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) 21:56:12 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x42}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r0, 0x80045301, &(0x7f0000000000)) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r1) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x2) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) write$nbd(0xffffffffffffffff, &(0x7f0000000380)={0x67446698, 0x1, 0x4, 0x1, 0x1, "a43a0fe4c7752f2df2e17dbba3bc0b5a2b8b11e499c55531d0fa0ace3c1728dac4e34a000d4025cf6f87395291efc57e11d38a2c843584b57e48393d18580b058376ec1e6c3a3a1db5d5171c9f2b185caae100c572cb67bdaac3d241d17183d26d593b77d99ea0ccbb07ff17b7db55fbe050539ebb845a130229e0b7d3dcd98b6cae"}, 0x92) fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) 21:56:12 executing program 4: pipe(0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x446441, 0x0) close(r0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) 21:56:12 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r1, 0x8008ae9d, &(0x7f0000000100)=""/68) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x4e800, 0x0) dup3(r1, r1, 0x80000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0x4004510f, 0x0) [ 2476.332199] sd 0:0:1:0: [sg0] tag#2949 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2476.341392] sd 0:0:1:0: [sg0] tag#2949 CDB: Read Block Limits [ 2476.347406] sd 0:0:1:0: [sg0] tag#2949 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2476.356337] sd 0:0:1:0: [sg0] tag#2949 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2476.365513] sd 0:0:1:0: [sg0] tag#2949 CDB[20]: 9c 09 3f f0 09 21:56:12 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x400}) [ 2476.602870] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2476.611719] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2476.617812] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2476.626785] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2476.635732] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 21:56:12 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) io_submit(r0, 0x3, &(0x7f0000000200)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040)}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8, 0x1, r1, &(0x7f0000000040)="17b61ba4d852c3e1e3fb3f7259c3f74d948825f75d978052aabe57f8bc39966590bc25635e3b146bf40400b00f9775fc09373908e55165c502043e04f432e8de58bffcb6ab2764b2fa76401ea38bc2db855e59dd377eb5c6ac05d5890100f6a8101ae8112a322030270ce4da843557c794a22929", 0x74, 0x6, 0x0, 0x2}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8, 0x6, r1, &(0x7f0000000340)="9265c3815219d5d96aebf231e160824043b198abf40cf8ff63ec1231c390ea81fdf37134511215da2c7206d7b186459128b25f3b9d6a2d650188e247ce53829f0bf3833414c91f953954c3c0dcbf3b42cf4119cdc99b439ccefb0c9a2a794775c8c92186d9f875fb1653b3eb382bfdafef9a5d80c1353e98ed17e6a303a2ac2dc39b35fa8703d469", 0x88, 0x8000000000000000, 0x0, 0x3, r3}]) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000280)={0x6, 0x0, 0x4, 0x40000, 0x0, {0x0, 0x2710}, {0x1, 0xc, 0x6d, 0x6, 0x66, 0x8, "cb9f5498"}, 0xffffffff, 0x1, @fd, 0x8, 0x0, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000180)=0x1, 0x4) 21:56:13 executing program 0: ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x101, @fixed={[], 0x12}, 0x295b, 0x2}, 0xe) 21:56:13 executing program 2: unshare(0x40600) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000002c0)) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fd, &(0x7f0000000240)="ec9bd1dacbf55be2f9757e8189540949329da7956c6294634626e268") r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xf17) unshare(0x40040400) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000540)) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="40b3f8cf8ca28516da76329a9805002d502460021100fc00006e", @ANYRES16=0x0, @ANYRES32=r0], 0x3}}, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x77) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc00}, 0x26000880) epoll_create(0xfffffeff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00007a8000)={0x11}) getdents64(0xffffffffffffffff, &(0x7f00000002c0)=""/212, 0xd4) ioctl$SNDRV_CTL_IOCTL_PVERSION(0xffffffffffffffff, 0x80045500, &(0x7f0000000040)) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000000c0)) inotify_rm_watch(0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) 21:56:13 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000003f40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c}}], 0x20}], 0x1, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) ioctl$FIBMAP(r2, 0x1, 0xfffffffffffffffd) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r5 = socket$unix(0x1, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000003f40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c}}], 0x20}], 0x1, 0x0) ioctl$sock_ifreq(r5, 0x8933, &(0x7f0000000080)={'dummy0\x00', @ifru_map={0x7, 0x5, 0x0, 0x0, 0x7f, 0xff}}) socket(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000180), 0xc) sendmmsg$unix(r6, &(0x7f0000003f40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c}}], 0x20}], 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)}, 0x20000000) bind$packet(r2, &(0x7f0000000040)={0x11, 0x2, r4, 0x1, 0x8, 0x6, @remote}, 0x14) 21:56:13 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) bind$isdn_base(r2, &(0x7f0000000000)={0x22, 0x9, 0x6, 0x3f, 0x6}, 0x6) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:13 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) r7 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205647, &(0x7f0000000500)={0xa30000, 0x4, 0x20, r7, 0x0, &(0x7f00000004c0)={0x98091b, 0xfffffff9, [], @p_u32=&(0x7f0000000480)=0x7}}) r9 = accept4$tipc(r4, &(0x7f0000000600), &(0x7f0000000640)=0x10, 0x800) ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x89e1, &(0x7f0000000680)={r9}) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r5, 0x717947ff, 0xa2a}, &(0x7f0000000040)=0xc) 21:56:13 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000040)={r2, 0x8}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r3, &(0x7f0000000040), 0xff66}]) open(&(0x7f0000000080)='./bus\x00', 0xc2000, 0x140) [ 2477.567046] audit: type=1804 audit(1588542973.837:1196): pid=16586 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.5" name="/root/syzkaller-testdir549992396/syzkaller.fN1Lan/1163/bus" dev="sda1" ino=16658 res=1 [ 2477.634589] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2477.643607] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2477.649623] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2477.658585] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2477.667532] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2477.717313] audit: type=1804 audit(1588542973.987:1197): pid=16594 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.5" name="/root/syzkaller-testdir549992396/syzkaller.fN1Lan/1163/bus" dev="sda1" ino=16658 res=1 21:56:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:56:14 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TIOCL_PASTESEL(r1, 0x541c, &(0x7f0000000040)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r3, 0x8982, &(0x7f0000000000)) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000080)={{0x1, 0x0, 0x9, 0x1, 0x7f}}) [ 2477.910653] sd 0:0:1:0: [sg0] tag#2949 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2477.919539] sd 0:0:1:0: [sg0] tag#2949 CDB: Read Block Limits [ 2477.925731] sd 0:0:1:0: [sg0] tag#2949 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2477.934808] sd 0:0:1:0: [sg0] tag#2949 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2477.943689] sd 0:0:1:0: [sg0] tag#2949 CDB[20]: 9c 09 3f f0 09 21:56:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000003f40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c}}], 0x20}], 0x1, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) ioctl$FIBMAP(r2, 0x1, 0xfffffffffffffffd) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r5 = socket$unix(0x1, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000003f40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c}}], 0x20}], 0x1, 0x0) ioctl$sock_ifreq(r5, 0x8933, &(0x7f0000000080)={'dummy0\x00', @ifru_map={0x7, 0x5, 0x0, 0x0, 0x7f, 0xff}}) socket(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000180), 0xc) sendmmsg$unix(r6, &(0x7f0000003f40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c}}], 0x20}], 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)}, 0x20000000) bind$packet(r2, &(0x7f0000000040)={0x11, 0x2, r4, 0x1, 0x8, 0x6, @remote}, 0x14) 21:56:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:56:14 executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f00000000c0)) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSRS485(r2, 0x542f, &(0x7f0000000040)={0x523c, 0x5, 0x307}) prctl$PR_GET_NAME(0x10, &(0x7f0000000300)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz1\x00', 0x1ff) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000000)) getpeername$llc(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x10) close(r1) 21:56:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001a"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe2, 0x0) 21:56:14 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, r4}}, 0xa0) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000100)=@get={0x1, &(0x7f00000001c0)=""/168, 0x8}) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000280)=0x45) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x800, 0x0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) r7 = fcntl$dupfd(r5, 0x406, r6) ioctl$KVM_ENABLE_CAP(r7, 0x4068aea3, &(0x7f0000000340)={0x74, 0x0, [0xffffffffffffffff, 0x624, 0x0, 0xa3fb]}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0x0, r1, &(0x7f0000000040)}]) 21:56:14 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = socket$kcm(0x29, 0x5, 0x0) fcntl$setflags(r1, 0x2, 0x0) close(r0) 21:56:14 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') r2 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r8, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r10, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r2, 0xfffffffffffffffd, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010002000000000002000300", @ANYRES32=r4, @ANYBLOB="02000000", @ANYRES32=r6, @ANYBLOB="040004000000000008000100", @ANYRES32=r8, @ANYBLOB, @ANYRES32=r10, @ANYBLOB="08000600", @ANYRES32=0xee01, @ANYBLOB="08000400", @ANYRES32=r11, @ANYBLOB="10000400000000002000020000000000"], 0x54, 0x2) 21:56:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2478.762035] ubi0: attaching mtd0 [ 2478.783560] ubi0: scanning is finished [ 2478.810102] ubi0: empty MTD device detected 21:56:15 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) getsockname$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000040)=0x10) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NFT_MSG_GETRULE(r2, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000640)={0x878, 0x7, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_RULE_USERDATA={0x23, 0x7, 0x1, 0x0, "f7b88d347eb6e830e776a9fd7a57a5d622d277b188885bef80ac953e4defc9"}, @NFTA_RULE_USERDATA={0x81, 0x7, 0x1, 0x0, "b2cc7204c3eb3cce31d6d650fdd7496a6db5ff00f6499c29d826af818f03ff8c5c0f11ead439a0ff33592af60a830e5e27c3db34255e2222794f13f0a800253c98b1410e69f0410df3725420a984d0aeab1fd1743358e1d526514f746a266d3f6f93d4e4490473e44887936f4b2feddc510eee4dfbd03d3f0de63c2c3d"}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x77c, 0x4, 0x0, 0x1, [{0x638, 0x1, 0x0, 0x1, [@fwd={{0x8, 0x1, 'fwd\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_FWD_NFPROTO={0x8}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x3}]}}, @xfrm={{0x9, 0x1, 'xfrm\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x4}]}}, @masq={{0x9, 0x1, 'masq\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x41}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0xd}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x5}]}}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x4}]}}, @numgen={{0xb, 0x1, 'numgen\x00'}, @void}, @limit={{0xa, 0x1, 'limit\x00'}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LIMIT_BURST={0x8}, @NFTA_LIMIT_BURST={0x8, 0x3, 0x1, 0x0, 0x9}]}}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @void}, @cmp={{0x8, 0x1, 'cmp\x00'}, @val={0x4f4, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x94, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0x1c, 0x1, "c83013ea554ca03885a2cea7a99d34ceacebdc641aa1a1fd"}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_CMP_DATA={0x3bc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2b, 0x1, "92d593ab462619378bf1b34feb9ef3cfbf0298dce03ba95ee19911b426831d4d4ba91f1282b125"}, @NFTA_DATA_VALUE={0xc4, 0x1, "33f8123a493cbac918d38ae7f7922fc4f58c81f5dacdb0b1d8fbba78e958c7e6687b6838f5dbd425f3f725eacb83815aa6b255fdeccfc42ede349bdbafe37750fb843bcf86fc960617c174f436e83390fa8f278080cf1e17aeccd72dc152b230de2285caa219607d6adb06eca449533f99a82c478a808fe319e812f350dd841ff30cb05c6518afbf5c9a274b312fad6fb3158f9ef29de7fb7b6b2adba3c6df3f7796291a95ba73b34551f868a18a8d572614f89da4225f3205c405174b9e1bad"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xa2, 0x1, "49803f5a1b91abc46f9e429425e9d20dfbcfc4d5a0bb5c6c5a2c08c87b6db25d2a54cafab2a3ef32feccffddaeb316df7054309631f4084aecf97a3eb821b1e1b7a3992cdc203e21a53220cf55b56d37e8c476d8d2ef1df3986616235e6840bbb5323364eafef1cd02458e371294f88dbd1d22d4103b27bef06304cad94752942e116f5467d6c557a155b8e0e7622c7d03867ab3233e35c6b07d305f46fb"}, @NFTA_DATA_VALUE={0x83, 0x1, "c9a1bb082eea801d2e8f5b31b04d90882670d6310ea968078f4fca1a0cc7c170b35e4933071465726f398d24de0b2ae33b5c6c0f030a5c37faad1313e52b89dfc245d43d5e33224c805f9f9663f6c3523a9a670e9589985d38653d5518e8740025ddee9dc39282d991bb597a1a5eebca23a98711554a4e2493f5d4ebd52ce3"}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x78, 0x1, "697781552ebfcf85cce609077522f49e402615b20f564b6b7e35430cd0f208d6ad54dfae85f136fdc6de2d7760272748c7ba7cab0a69ccf423bdd8e3a9f358083608858c404cb990229fde2a2c3cb07316272109857c5580d4ef0ec16bf619b70de202d88b1bb55b9dc7aeff53d44ba1b0e901e4"}, @NFTA_DATA_VALUE={0xa3, 0x1, "b465aa8517eb079fc69f4796476d4a6460f47b089b5ba2c987b4068babb35a731adbdb371d89adddf2366bf62cf822c23e19651fc795d49e393f903d4ed2ca7d80f7a87de93abc843161c945da19d59c4b38eadeb3083e2b0d90a9fdde670ba5027d8025f1eb73344c82ff4678699ea0a1e6eb659b3aff70c89502b3d55174854ab0ad2a6182aca7cbaf1e759726f02fa1424728b600b508c1019489db6131"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CMP_DATA={0x88, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x61, 0x1, "e7ab7aba17bf29266c29d9cf4344104bfb9266e04e0fe57f5d4e449ec88875d78f5481f8c998340cf005b34d6bc9f38d8be6df993da71f07db5bb77fa98f186a745e5f3d9bcdd70f9cfe1e33a106b6ac5cf0fe8720cd0e2fb9afe9e820"}, @NFTA_DATA_VALUE={0x1d, 0x1, "230a01d5f6eabfceb32af02899824d56f0064f87cf1964bea9"}]}]}}, @ct={{0x7, 0x1, 'ct\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}, @synproxy={{0xd, 0x1, 'synproxy\x00'}, @void}]}, {0x60, 0x1, 0x0, 0x1, [@dynset={{0xb, 0x1, 'dynset\x00'}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_DYNSET_TIMEOUT={0xc, 0x6, 0x1, 0x0, 0x800}]}}, @objref={{0xb, 0x1, 'objref\x00'}, @void}, @lookup={{0xb, 0x1, 'lookup\x00'}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_DREG={0x8, 0x3, 0x1, 0x0, 0xf}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz0\x00'}, @NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x16}]}}]}, {0xe0, 0x1, 0x0, 0x1, [@lookup={{0xb, 0x1, 'lookup\x00'}, @void}, @dup_ipv6={{0x8, 0x1, 'dup\x00'}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x13}]}}, @limit={{0xa, 0x1, 'limit\x00'}, @void}, @dup={{0x8, 0x1, 'dup\x00'}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_DUP_SREG_DEV={0x8}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xb}]}}, @byteorder={{0xe, 0x1, 'byteorder\x00'}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x65}]}}]}]}]}, 0x878}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 21:56:15 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x202000, 0x0) close(r0) r1 = syz_open_dev$vivid(&(0x7f0000000180)='/dev/video#\x00', 0x3, 0x2) preadv(r1, &(0x7f0000000500)=[{&(0x7f0000000280)=""/196, 0xc4}, {&(0x7f00000001c0)=""/88, 0x58}, {&(0x7f0000000380)=""/122, 0x7a}, {&(0x7f0000000400)=""/224, 0xe0}], 0x4, 0x400) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x4, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0xa0) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000000)=@buf={0x63, &(0x7f0000000080)="f1f9b99e22b7b9f4653b6cb123bc4862d71828b433fda2789a5d639477d55991ccf55d39b2419c5e33e98208368099be940ef21fc0e5c939a8c55f599a46578dc355bc4f421011eb3384756018d3a83905fc6dc65e59f3154e68a3640540fccfc6741e"}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r3, 0xc0505405, &(0x7f0000000540)={{0x0, 0x1, 0xfffffffd, 0x0, 0x401}, 0x100000000, 0x1, 0x8}) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r3, 0x80585414, &(0x7f00000005c0)) 21:56:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 2479.096440] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2479.121842] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2479.163062] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2479.199129] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2479.232934] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2479.267912] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2479.304300] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3626484052 21:56:15 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) close(r0) [ 2479.346229] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2479.385498] ubi0: background thread "ubi_bgt0d" started, PID 16650 [ 2479.397157] ubi0: detaching mtd0 [ 2479.417502] ubi0: mtd0 is detached 21:56:15 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') r2 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r8, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r10, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r2, 0xfffffffffffffffd, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010002000000000002000300", @ANYRES32=r4, @ANYBLOB="02000000", @ANYRES32=r6, @ANYBLOB="040004000000000008000100", @ANYRES32=r8, @ANYBLOB, @ANYRES32=r10, @ANYBLOB="08000600", @ANYRES32=0xee01, @ANYBLOB="08000400", @ANYRES32=r11, @ANYBLOB="10000400000000002000020000000000"], 0x54, 0x2) 21:56:15 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) syncfs(r1) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x2, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x7}, [@CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc014}, 0x1) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x40, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x60000}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1f}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000}, 0x4004080) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, r2, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040) open(&(0x7f0000000380)='./bus\x00', 0x40000, 0xfa) kexec_load(0x0, 0x10, &(0x7f00000005c0)=[{0x0, 0x0, 0x9165a000, 0x3e0000}], 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$CAN_RAW_LOOPBACK(r4, 0x65, 0x3, &(0x7f00000004c0), &(0x7f0000000500)=0x4) recvmsg$can_raw(r3, &(0x7f0000000240)={&(0x7f0000000000)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000080)=""/31, 0x1f}, {&(0x7f00000000c0)=""/22, 0x16}, {&(0x7f0000000100)=""/71, 0x47}], 0x3, &(0x7f00000001c0)=""/116, 0x74}, 0x20) r5 = socket$unix(0x1, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) [ 2479.532697] ubi0: attaching mtd0 [ 2479.551504] ubi0: scanning is finished [ 2479.600796] audit: type=1804 audit(1588542975.867:1198): pid=16674 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir605396375/syzkaller.wEhIKU/2768/bus" dev="sda1" ino=16521 res=1 21:56:15 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=ANY=[@ANYBLOB="164c29a1988cbc45102e19bed1f9eaf8774d1e38cfcaf222fce30e5e0f41d1ea2ee50b529cde9e7e881e77c38f33913845ed03dd12b40984e9b2e01720795dcde328b3e07ae21930eb9238ad27a58e808fb989f4d6e1bb124463fc0905ff67f8069dbe7a7b48331305dbfdbcab689c4296c053f651d8", @ANYRES16=r3, @ANYBLOB="01000000000000000000060000001400018006000100000000000600040000000000"], 0x28}}, 0x0) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800c8}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)={0xbc, r3, 0x800, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7ff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DAEMON={0x78, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @multicast2}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_batadv\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, [], 0x1}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x81}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}]}, 0xbc}, 0x1, 0x0, 0x0, 0x44800}, 0x4) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000000)={0x0, @bt={0x9, 0x7ff000, 0x0, 0x3, 0x3, 0x7fff, 0x0, 0x6, 0x8, 0xe8, 0x5f3, 0x62, 0x200, 0x3, 0x3, 0x0, {0x40, 0x9}, 0x9d, 0x9}}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_tcp_buf(r6, 0x6, 0x2d, &(0x7f0000000640)="2352a89d50ddc73df867bfe0321235c4161a7836cb2923fe1bca8ab4328fe42abc432902d00196224ab03fba62443e4022937ccc2503d01badac5361dd3d31d9ba8e47f53793e68f04a16a849a0fee7b224e2e6e0fa63c3d61f8373dd0a5cf49dd15c2a590fa9d65392aeb6633048626ddc3ea2af6c2900304d278eefe03cb60355aab46dd", 0x85) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r5, &(0x7f0000000040), 0x0, 0x803}]) 21:56:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2479.705788] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2479.735250] audit: type=1804 audit(1588542975.967:1199): pid=16679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir605396375/syzkaller.wEhIKU/2768/bus" dev="sda1" ino=16521 res=1 [ 2479.741831] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 21:56:16 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x10280, 0x100) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000280)={0x73, 0x16, [], [@generic={0x3, 0xb2, "ca6ed9e23df8a1f148b2e19e380059376308213d4e9652e20564b874867c8e6f6b5c604ed8fc9cbca3264281524d6728d426368f81a485393149db2854e216737ec3e085d9f592e870fc4787ded91a8cb01a67d241077411301fe72ae0da9835f9ad21fc2096ae136efcfd479d3f1a81da030be6383eb1590f4dc035e4d592839e081349298df24fc728313f26d32a5e5fbe411f8ebcb9583969eb79b9f2c4e33b44d878860fa4487dbef44963fb8a34eaf9"}]}, 0xc0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400)='batadv\x00') sendmsg$BATADV_CMD_GET_GATEWAYS(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)={0x1c, r7, 0x711, 0x0, 0x0, {0x9}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, r7, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffff000}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x80}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x14) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) socket$unix(0x1, 0x2, 0x0) close(r0) socket$inet6_icmp(0xa, 0x2, 0x3a) 21:56:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f0000000040)=""/156, 0x80305}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f00000001c0)=""/67, 0x43}, {&(0x7f0000000240)=""/198, 0xc6}, {&(0x7f0000000140)=""/15, 0xf}, {&(0x7f0000000340)=""/54, 0x7ffff}, {&(0x7f0000000380)=""/42, 0x2a}, {&(0x7f00000003c0)=""/77, 0x4d}, {&(0x7f0000000440)=""/244, 0xf4}, {&(0x7f0000000540)=""/219, 0xdb}], 0x7}}], 0x48}, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r2, 0x3) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000880)=""/134) [ 2479.865888] audit: type=1804 audit(1588542975.977:1200): pid=16679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir605396375/syzkaller.wEhIKU/2768/bus" dev="sda1" ino=16521 res=1 [ 2479.876386] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2479.960786] audit: type=1804 audit(1588542976.037:1201): pid=16679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir605396375/syzkaller.wEhIKU/2768/bus" dev="sda1" ino=16521 res=1 [ 2479.979581] ubi0: VID header offset: 64 (aligned 64), data offset: 128 21:56:16 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) [ 2480.014413] rdma_op ffff88820a984d98 conn xmit_rdma (null) [ 2480.029148] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f0000000040)=""/156, 0x80305}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f00000001c0)=""/67, 0x43}, {&(0x7f0000000240)=""/198, 0xc6}, {&(0x7f0000000140)=""/15, 0xf}, {&(0x7f0000000340)=""/54, 0x7ffff}, {&(0x7f0000000380)=""/42, 0x2a}, {&(0x7f00000003c0)=""/77, 0x4d}, {&(0x7f0000000440)=""/244, 0xf4}, {&(0x7f0000000540)=""/219, 0xdb}], 0x7}}], 0x48}, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r2, 0x3) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000880)=""/134) [ 2480.056481] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2480.095260] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 21:56:16 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r3) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2480.130716] audit: type=1804 audit(1588542976.077:1202): pid=16674 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir605396375/syzkaller.wEhIKU/2768/bus" dev="sda1" ino=16521 res=1 [ 2480.134678] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2480.214525] rdma_op ffff8880886043d8 conn xmit_rdma (null) 21:56:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f0000000040)=""/156, 0x80305}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f00000001c0)=""/67, 0x43}, {&(0x7f0000000240)=""/198, 0xc6}, {&(0x7f0000000140)=""/15, 0xf}, {&(0x7f0000000340)=""/54, 0x7ffff}, {&(0x7f0000000380)=""/42, 0x2a}, {&(0x7f00000003c0)=""/77, 0x4d}, {&(0x7f0000000440)=""/244, 0xf4}, {&(0x7f0000000540)=""/219, 0xdb}], 0x7}}], 0x48}, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r2, 0x3) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000880)=""/134) [ 2480.308795] ubi0: background thread "ubi_bgt0d" started, PID 16681 [ 2480.333930] ubi0: detaching mtd0 [ 2480.349050] ubi0: mtd0 is detached 21:56:16 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r3, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x40}, 0x103, r5, r3, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x7f, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x1}}, 0xa0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000128bd7000ffdbdf250c00000050000380080003000400000014000600fc0100000000000000000000000000001400020079756e6c300000000000000000000000050008003700000014000600ff010000000000000000000000000001ebede5ae9055d93e81dc632c35ad9bbe981007d27014379a7770e7266b0a4ea7d0bf98b10078ebd3c587409fb7da293ba35a25d45d4a47d8f38d88a2cbdbf2b1b561"], 0x64}}, 0x40801) 21:56:16 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000002c0)=0xc) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = ioctl$NS_GET_PARENT(r3, 0xb702, 0x0) io_submit(r0, 0x2, &(0x7f0000000040)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040)}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x3, 0x3ff, r4, &(0x7f00000001c0)="c0d18e2875a69b5f6fd06d84f3423c46ca75761cd5acb93a73fa21f1d1a8aca03ed478ee6434ae326765f357797c2c2001fdd4afd52bf9271e619dee7caf1a48028b9777f1c0e442398b62e8c09e35532058745b74e12139c55ca5b4ff99d77915063c07e8b2cbea739d68687969f57d96106216a6fbadf88a913940a133933e3fb606da6275f60cc8ae9b313de131af1b27b23a705a11e7c00a9804544ba6a8fac1621e2df911a0b225f5a61ed6049ea4ac65acef7ba5aacd26f2b131e37e81fb995a8869f907d1af5ecabcbcb5c729d82b42406eaeed4c83e44541ade86f3872f8d850f6da7ae344", 0xe9, 0x3, 0x0, 0x2}]) 21:56:16 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') r2 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r8, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r10, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r2, 0xfffffffffffffffd, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010002000000000002000300", @ANYRES32=r4, @ANYBLOB="02000000", @ANYRES32=r6, @ANYBLOB="040004000000000008000100", @ANYRES32=r8, @ANYBLOB, @ANYRES32=r10, @ANYBLOB="08000600", @ANYRES32=0xee01, @ANYBLOB="08000400", @ANYRES32=r11, @ANYBLOB="10000400000000002000020000000000"], 0x54, 0x2) [ 2480.460617] ubi0: attaching mtd0 [ 2480.467628] rdma_op ffff888082420418 conn xmit_rdma (null) [ 2480.491357] ubi0: scanning is finished 21:56:16 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x148, 0xffffffe6, 0x178, 0x148, 0x178, 0x218, 0x258, 0x258, 0x218, 0x258, 0x3, 0x0, {[{{@ipv6={@mcast2, @private2, [], [], 'veth1_to_bond\x00', 'netpci0\x00'}, 0x0, 0x108, 0x148, 0x0, {}, [@common=@unspec=@quota={{0x38, 'quota\x00'}}, @common=@inet=@socket3={{0x28, 'socket\x00'}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}, {{@ipv6={@ipv4={[], [], @remote}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], [], 'veth0_to_team\x00', 'hsr0\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x100000001) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$MON_IOCX_GET(r1, 0x40189206, &(0x7f0000000080)={&(0x7f0000000000), &(0x7f0000000040)=""/35, 0x23}) 21:56:16 executing program 0: ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RSTATFS(r1, &(0x7f0000000040)={0x43, 0x9, 0x2, {0xfff, 0xfff, 0x100000001, 0x7, 0x0, 0x8, 0xb3cd, 0x10001, 0x5}}, 0x43) close(r0) 21:56:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:16 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = dup2(r3, r4) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000640)={0x0, 0x0, @ioapic={0x10000, 0x8, 0x9, 0x8, 0x0, [{0x5, 0x9, 0x5, [], 0x7}, {0x9, 0x3, 0x3, [], 0x80}, {0xe0, 0xff, 0x81, [], 0x2}, {0x2, 0x7, 0x1f, [], 0x1}, {0x3, 0x5, 0x1, [], 0x40}, {0xd8, 0x40, 0x0, [], 0x3f}, {0x40, 0x1f, 0x9, [], 0xff}, {0x5, 0x53, 0x1f, [], 0x7}, {0x3, 0x80, 0xb9, [], 0x3}, {0x2, 0x4, 0x0, [], 0x2c}, {0xf3, 0x9, 0x0, [], 0x1}, {0x5, 0xe, 0x81, [], 0x40}, {0x80, 0xfb, 0x0, [], 0x6}, {0xff, 0x2, 0x1f, [], 0xff}, {0xa3, 0x3f, 0x4}, {0x80, 0x9, 0x4, [], 0x5}, {0x2a, 0x6, 0x7c}, {0x0, 0x4, 0x7f}, {0x1f, 0x9, 0xf8, [], 0x4}, {0x20, 0x8}, {0x4, 0x80, 0x1, [], 0x3}, {0xc0, 0xd2, 0x9, [], 0x41}, {0x3, 0x7, 0x26, [], 0x6c}, {0x80, 0xff, 0x9, [], 0x3}]}}) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_SUBDEV_S_CROP(r2, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0x782, 0x3, 0x8e, 0xb8}}) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'tunl0\x00', 0x2000}) [ 2480.692908] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2480.725947] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2480.770155] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2480.776936] Cannot find add_set index 0 as target [ 2480.785645] Cannot find add_set index 0 as target [ 2480.819910] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2480.863864] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2480.886351] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2480.913491] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2480.934173] selinux_nlmsg_perm: 387 callbacks suppressed [ 2480.934183] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 21:56:17 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) getsockname(r0, &(0x7f0000000340), &(0x7f0000000400)=0x80) close(r0) r1 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r1, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x400000000000197, 0xc000) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000400000000000000000900000008000a00406e92a18f00508004000600040006000a0006000180c2000001000004000a001400e0d5a3000200040001000400010004000100"], 0x4c}}, 0x20040050) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) sendmmsg$inet(r4, &(0x7f0000001dc0)=[{{&(0x7f0000000480)={0x2, 0x4e27, @local}, 0x10, &(0x7f0000000680)=[{&(0x7f0000000740)="7cfcf6365167a5b430e057aa0d2c3861ab4fc1367279405aba99d9530f98ebe92f2d01915bc74a87df3a253cd5d6e2e536daf3061852135a725afdc9b21bfbe0b33fe89d84416e0a0b20457a8fc1e44b07d5b875a5a40a8d0734229e596989d9edef24f580d71e3d1116454289c74da2f311240990bae9cbe569a13642a1cabbc0a7cfb88bdeb58f407a85fc4591eb3124a9fd808c541d6ce00559736ea63446234668ece15a01b79cd6411790bd349ca23d2750d1e1b375b79f6bbd9a1e83a7e2d5cb827b57cc2d716cda9a89036f26d6876ca9c02bb2972663e6fa134d745a3b1b45044a08deb8eccf940ba7fc1c3ced6d4d573d20a1548770a16d2e97e6753af6569ca9c5e06d0bf0dbf116129663e666ec2270f0254e0db3474a3093ebdaabea563f96f93f60fe5bc46b6c90800b0365169bb047382668e3499be07fe3b5e609625bcd6c4215f89f9af22d4e80c63902175d00aeb95625a78b1b87919d449de86b6409b071467b4ce18ea45a4713c83e582a8627ee57ccea73fbcb8e5993cb6b3fced3228228325645174fd3d9bdc8842f2f464e67456f867c4fdacc651e57220a4af830f72224b56ec5b9852bfdc48269c2cd00f1be810f9139f8b0ae618c0d9f6dfbe308bd33689b6b51bf8a71ee12fd2542fba41c8239e3025792952c61686cdaaf07636f978f58ae820ab239dabce97533a7b1abace2c1991c37907292aee715a5b108c10c2b2c67a9b8d674715df3763624c836a0c6adcced476c2f07eff7fecf3209ea7023c08cad083e80f29657c2bf0a6d33f49ff30b61780503d57130f8cf831cd49c19f6e2f45f598dce0b5637b6928bf85061f97dc58802fcc2303868c5a563ea377d529847bff249945e1fdddd490a2cdf54a0f02790447741cad0b4f2d1aece92f12749d2ae738f6ebe725820e77cf4822f1ff8324bb48cfdb122b471b5587265b5010c10bf186cf41098afef02beff564653c82e425f18ece977ea9aec3d02d5c7521a014553a172b0162f27e5aeee27d59fdd0d1c7a4a18beca8803f78ae4960836299442c4b9d65ee9f92ecc734475f003c655b650d67f43a9cacf355f4e82eef9515751d333afb9feb8f65927bf6177e8c7852c60b9493de06fce03523aa37a6037d05d6d42b67498b72a81c9304e571dd4da22627a9b389ba2ca9ec2590289aa9b077db4f27022c96e1870d8a3453e86247adad4948324a7fffc96ff96e92c530f8f5cebe963af52a959ebf3719e7ec7822b32999e34ea9db6d71caa0987a4bf0c80a89b47dc586581fc2bf716b1dc8d07c9b6635a99d01a3fc463fd75941d224d47b211ed8e140e22632a0b7d1af1d0889dae04b6555f74a1606149394b37d5f823765628574514fe1289440aec49c31ea85ad91e0cb27fea52a90de1446cecefb0e6da43cf48ed11d76b3cfa6b135711f5f9611cdce0a9e12a26ef97f9e4b5bc4c80b31558e90677cbc0f3e15e1327f10205b260404e27f99bff165a28fce33a870f9d4ecb4762226b721fd474877db8c9658aceab234e48be8ef161bfa6059fde8d5b3d3784adcf497c4a6e3bc422c7d297f047a057376f202132e5ce71a52fdc514f46f2779ade24c5cd9f5d96f84157fb8bf3d95aae22dc62d564945e0b758a6ab28c358bad5dc044509ea87baf218585ab71b90d51350518ff942fa7be826622433265f008d0d14f5b4dd68d9ae8d64aafd41dc77cd4c8c71443fb6c8917478ff79815753d52ea6a8d298deb28fc8867ed97f228f906cfc157d7fc139296cd1cea48dd7e0aa0d2cf9e901164651f3a6473d7f4f1fd5ec62fdda2af6c1f67d00e66552c749099e4e82546de4dace4feab98a0fecfd3a16309c2c9a9b02e283755a62511567e4edf4aed3d2fc7daf157015ab60c95cf661af557b6ddaab011fb8e1f602d951c7c1532d26651c26c5b562f63db81e04f7c04a9cbcc5d35167a18a6caa0009e102ec847e0945db7392b5c3d0a9883d2e668e276ff7119becdc89fc53e41677111d8a4a59323bbb232e698ede44dc4d02d78fb829e53285316b69f39781c93827c6aa6debb44d3b6cb395c3bb7c7560def0567d1e644792a9d2944c23312837071d5bfbb38b2c2c2efb549e12e2b83b22b156e947415cd4df8a9a524aecaf058a9f532c7d708b3891b5b4d30768319f7becf03cf4432ad33b1acd14b5202eb03146089d2adf89380f5bc16d4c4bbb5a015f0fa2e21717eb345d05b55d3f0e612cee62aa813af136ccfd6831174b3d89041d1f8ec2b32aa1cb78ad831452afffaa7a7d156f0c3c934bba60b5caafb40d77746a205cacc4a077fb8db0944bbc487571b3df88a2adf8427187fca070bef2897ac2ddfa1099041f2c03bfa8bd6dfe6f552db014b73f89776972d2993e965b6bad066950652c9c1511173f32a1bd2719f77f546f1da174b1ae94e8f811874cbf19c8bd8c38ab678e5a88aab81aa3ff1ec14ca347043db726bf425cfb50c6c31934d38951fcd11cd387a1ffc6d63b73110eb5abf331c907d6e7d2f509567d8418dae0e325b07b0710b827e9063dc7321c78f1e5f1c1bc0481c87f6812070c968d8dc279e15a8651c973d4c0d6dd931f3f2005a8857af5da6b0ce3748edc618df199da7827f10c3a6039cf26d5a5231e23013a0977c3c960f3bf1ef4b08391cfc586dd6aff9a030e89c8cb471b2d670d0705b2ec84ba819f7eb7e6474aa438b9829bb2400c233db0dad5e6e26f018626e7676f61a1cd1d06a3249c196b0986baf4c0f4733b8281ea8a971254d89c17f8232d00339fc5815361ca740d6ceacfc22eea421c0124e0f2dc5338f192f82b685f9bae46c6d2041efa441e59544057c265ace8acaa68a01a83a0bb963111c7e7e0a37f3cbb9db7f43b4d06704493234e5a90c6df8125b70a7340db7a76d29ea54ab338cc9772ebd7cab68be3658b9e963262e6005a396455d7160492a93a3e13b3e97986050d76b54d2e11e7a39f18c5c086194ce9e25fc554f55f2e513dd1ec1d54c657e8b3399df0150cd69f17349efb134e2e4c9297048bb0d3d424df43d305de24084a78c2025a5b261782d677685c06b8a5039c95c5ec747d337649056597e546338afd5a0aae43070e2d9c8a9a33f6f63224dc6ed87f50a7a06c0b09213561e6638f7825cd94eb4cecf49c999f6c9d5d5cd05475f94eff8b185929334533d2b9cabebf2d3364644fe96251faa4e3127998675fd6133b0df3b716b24eb717836d0d53d9e21784068344d4d76d3394f70cdfa1e829cd15427c4921f1ca3d45c9f525ed229a68b90829d38bfe1f5dcf1370c4f542da7a324351440e097abd577f163d1497f09b1519730ff3700d57488762db82e62a5a3cff2dd8cdef0229c486220c7eb2fa26bd37ea6884deb1fab70e37ec0863ba5a56180e130456594117fd093ffff89728cd0b18e5db2175c150d8580552c0da9b862f1c0ce515f5a69861bf3e1ff966f0d2cff8fc0fd7c7070f725d7e348737ba446d79eca340aabdab6df06df5ee3d62879e5568340dcaceb812dce5fd8276af965022680a5b99a0952f89e20751e3e4b13536c5cc91d2b5d0e622b5edfc6008095b46aeeaf878d21c52742b6574668947c7276ec09d6d43881c06988fe5c46cbea65b6bd0eccf8050952a9c95234b9b97995fd933e1b3e92787e5f64ade1576bbe1f9ccdbb7666ef96d6a37970951d4be40aca59455dbd05a302bb0a5b4b2844bc0afb411cb57edfac7b42e693aea5597437f627be12d5cca8b65a32235cd6d6788b2513b23840cbdefcadf5ef44b7500e1fb63aea2ec9bb40e0d6379644e6e4ed1adb210194529aada6e6d12c97617c99816cf9bfddbb63ca1aea9106fbecbf631fe4a39e1c3e46bc5ca46216e2527df51340903d7efa5d0e99c3d009cf2c9135b627a3777e0d0acdc1b176ecf94d10abc77a54e71c3f5a74dc48d8e9d27c0692e68bd1ed1f77a9b2729adb348070e4b1059743b7582bcc9029498f7d45ce5e9ef778369c9bea2a57e7f8610a5b359580b835ff87a8c2c2dbde1fae10b2c9a8b12b1b9026726f7cbd15294b5680189db0bcb6c1ec65c49816305c1977d2c9cd2b207c357d30cf363c73d8f9a87dc368acf05748b8efefce50797561692f7ffa8038c9164462e7326bfb152d5ccae7665816c4e5f5a7143202eb4c022396e7dc85225f97d2950441aca4b11fb69ff6387b1d191222d608db11da5e1433d23b306e770d4aeae17a04c5eae2d5c1a867bf3d09a8328ebdc7ae293a1d2b9dbc87b4fdd74485f6d2907a2ea199c35a7c5bfc43c414dabbd4941b8f4d16de8395b1af016b95ccb34285c57668be476e59e0a90522a6894e5d906fcf8956e34eaf24b7bc50d0cc4e6232e1ac9708a873536d4743f47ab91249866b582546d18875549b97a638dab822b115ba7aff95cd4ffddcfc1e87e4ad51d07edee97309115701ad521bab65497a868ac058e6b45fdf664640a10d850c516850f6a6fcd655ef48aecd62ae6615b1f5f820fa42c79522e9f8907ecb083283f55fb0cb5fc20fb436a686f5e37f5b5c97ab08a664bd9741e2cce7507ba5f5909ba84467ae0d6adee3b242765f35c8a1b6b55654c0f1c2d92baf68649ecc5dc0ad23ba201d0632977fe04b631d5a6acf88a6abd7300c6f550c96d4b4112eb4c08dd15b04d92f08406048161ee6166e0e6f42c1751e4376e5114b316d6554aa6fa54fe060fac4435b1843c9eac545a58ca34ccc74eb6dc5a12c19cbfce10d4b49bf417b6f6712779fe5a3fe6a98f2382054542c099b32cbd585ff6212fb20f7f77d26f10252e9684a5590c288ef740425fb82f179c4a889823bb3b2ea5e62be744617b309e864f92d3d043db9d8aa21f67cc037ef0707328a84c8660261360ed873d0d740a952795ecb9a23ab0ef27ba2ffb274da16b6432752e6633db7d0e420f5aedb64bfdb8f610f0eed6386f9d5c4c6d71c1c60578b2e4690a39abf1724b76f062ecbb5292142d4abe8317be32f44f3191ecf4e7ad019fed8f60f4813027e018b91f7da53a3573192b9334ce3c3b8023a750c238fcffe78db66303108ec77e9811c1f8a5215b11680c23fb84f3624736b3ac236bb6daa1b564c711c54026d3acd87e99f89294d552af00f82d7e0dbc4ede31433c18ed39c2867134454c6cc3be3a143e71fc87d85876bf8dfaf637cbcf38faf4ac04248f35bb269113dd19494cb0b475c1357ae39f80382b6adc4f156f2aebcb25bb8667580f9b872ebf4a862d4e57dc08f7c86261c6f9fdd1a58c0ed2d4bd6d576a1773ac8b8ab8fbc444c20de9ce8e4270d44d4a4010ea2004a6baab507c2181ebaf5a74fb0fae9934b3e14bc7d18f3b546d3dc14f35201d5c91ab08f0070934a4c0a3a642ab33aad6624a3a3e47e925d2e06bf85cdda8fa47099290931f5b57194852418e234d841735e6146a2241a8e6eb3b1bb52c566faa9a32c40d5dd114c2b40617ee4610b1510e4472e8b58c86853ed8b66b96acc87238b13e5a5b7f60fde35e329df023d36976eac1ff1bc443b02ee1cb3474d29b362360efc59c0865d04d9c8b6f5d14d891e09cc9d5389748e1c5b8bbd4678aeb7c975e0603ff7b422b484c805f4e49001f78432d16216cf2afb9d0a73eb91aaab0b48fc8ede81b08c650286892f6bbfd411d5e7df309dbf3dc0f707fd50a71f93e140cf115860916ea949f8878f6071607491825dbeef27114cf8fae40888a50a89c7fe4cab841f2540cb9c421755880fad3ceb88cfa9c30da917a55e0f38a6b64f65d7187efa35d58581ed23c284aa73c465", 0x1000}, {0xffffffffffffffff}, {&(0x7f00000004c0)="44d2a393117b692eae0539367d63027ba5bcb544555511dd8bb218a95b0b8b07338fffec49b060443b5903fd66fed9d2998251c58176027ece052416a5dd7f0b99660fc79c5d2be501ef9aa8222b154c14397bca82e37855162a4cb72b1ce3129c0f1a5a8bf5ad2183ad9274065f8a45e23937b2d82e63ccb1240442674adf80dd6f0aafb91477bc70ddbb7115e695d85efd97c5718730e57177462b9dd2c5a17809ea8af1810e1a2350cec9768e7a5e0286b353ba6661e5f127760bda59b574e81ce342fb0a460e3651cb83311a714adf", 0xd1}], 0x3, &(0x7f0000001740)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xe813}}, @ip_ttl={{0x14, 0x0, 0x2, 0x9}}, @ip_retopts={{0x54, 0x0, 0x7, {[@end, @generic={0x89, 0x5, "31c175"}, @generic={0x88, 0x3, "14"}, @timestamp={0x44, 0xc, 0xbb, 0x0, 0x7, [0xfffffffe, 0x7f]}, @generic={0x94, 0xb, "0900000000000000cb"}, @generic={0x44, 0x6, "fdfec63e"}, @noop, @timestamp_prespec={0x44, 0x1c, 0x6f, 0x3, 0xb, [{@multicast2, 0xffffffff}, {@local, 0x401}, {@empty, 0x9}]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x6}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xe6}}], 0xe8}}, {{0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000001980)="1b5b4d35addb51487bedafcf0eecfb5ed918c50992e74a89ce101dfe28fc753f4b2272ddd0300f4d5128617622bed5fb1237304dc64a1c74f430634b403213458da4ce54aa1688ff5d8116a87c96ff9cfa57d96efffc2247f8123e36f6a9080f79d28d894a639a068565fa3a43e8e315cb7a88bf0e7e37ee649f89a1e1b734addc9d18db484050113261b7c127a11913af321f4199785a58caf8df9585c1c826fab4eeced2f24c1dda07f68d34e577f814806620ebbb8d99aed3a358eb4999ef15bb3a8da081f39addb5074f7b2c9be7ee03769d91906118b0ff9a67aa5a505bf0ebaf9a906dae4cfb94b3", 0xeb}, {&(0x7f0000001a80)="6d79b360240893aba663ac44d306a7e641bcccf137bb9d2d0d1fab7f7a054a785dab9a826324817fe92971e8d29705ee874364939c62efdad0e6cf4a935262ad449bbe2dd0ed5736aa07c7ef5b528d9a5f9e7cc9efabe89968ff5451bc437b465c461bb87750f17ea959caea94f75dcd39c59680b8a6483eebbaa27d469d30c25b7895bbbef42b83191600147bd61ad0194baaae0a7337620de36ecf82b214315bd50becd42d01255ab7cdb5ef1d5b3ea7927e03", 0xb4}, {&(0x7f0000001b40)="d2e5321c0dab7c3999c1ad998d4bbc1220b5387e4a13371a620b4c1d2ce318b804ccef59eb9d5ea28a7bd60a4921954d7ab2b510c74a4d63e9ed65d702555464f9ba3b6d1eda8af864fca4f9de735ba1098ced5752ab5055d4ca338747bfd668fc1b9b966df0309dd4ca930198915a864573f3615d8f64a5477624e94d2bd445abd2d570a4047195b38a936924c037e56bfa177fad8c880ff717fd39833b1d3a973e9c092b187fc4b22d24b8cc491cb5fecb8969e802028b0d3177a169ee242c42c724467ab9a2e4592b13de5b894b8d92c7bacbbf7b6e99a602a69a08", 0xdd}, {&(0x7f0000001c40)="3ad16a3f618a9e94f0cc2b82dafcd1bd54d60213d11ac3e42876e97ad9417f448a24b738e3", 0x25}, {&(0x7f0000001c80)="5adba2e95771e351ff19dd445a43a12541a83b7f27179620ac273a9e7884561ffe78d7c6a6ecf197eff3308ee28c7e16d638577323256ad69e8be517c88971ee7cfd9d97f744efccbf5185334db4604cc08bf758e8ac464eed2666f54edfdf36cdccdfb3ee68ab92f695ca6f3ac6dc7936c3df4e3b2632dc7ae050a968ac0b91402f64275feabd64a7c483d50b0bafcbe50f7a7f18bf51a494b8f5ac32d4da3d7c71ca5e5d8bcec8e1fbebe1dc31c065066ef9", 0xb3}], 0x5}}], 0x2, 0x20000008) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f00000001c0)='/dev/dlm-monitor\x00') sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, r2, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'erspan0\x00'}, @NL80211_ATTR_IFINDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x4040090) [ 2480.966548] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2480.979022] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2480.979378] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2480.999977] ubi0: detaching mtd0 [ 2481.009649] ubi0: mtd0 is detached 21:56:17 executing program 4: r0 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r0, &(0x7f0000002280)=[{{&(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2b}}, 0x10, &(0x7f0000000ec0)=[{&(0x7f00000002c0)="ea7591d2242434c387e59016d9dd822e5d461df3d25cf68be0bb0067a20000000000000000000041", 0x28}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000002240)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @multicast1}}}], 0x20}}], 0x2, 0x0) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00040000000000000000d9c54af10dfdcee33a5a0900000008003700020000000c00508004000600040006000a0006000180c2000001000004000a0014006e8004000100040002000400010004000100"], 0x4c}}, 0x20040050) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r8, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x5c, 0x0, 0x704, 0x70bd2a, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r4}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xc000000, 0x2}}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_WIPHY={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xdb, 0xffffffffffffffff}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000001}, 0x4044001) 21:56:17 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x10000, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, &(0x7f00000001c0)={0x200, 0x0, &(0x7f0000000040), &(0x7f0000000080)=[0x3ff], &(0x7f0000000100)=[0x10000, 0x6, 0x5, 0x6, 0x0], &(0x7f0000000140)=[0xffff, 0xff, 0x0, 0x1ff], 0x0, 0x7d}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:17 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') r2 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r8, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r10, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r2, 0xfffffffffffffffd, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010002000000000002000300", @ANYRES32=r4, @ANYBLOB="02000000", @ANYRES32=r6, @ANYBLOB="040004000000000008000100", @ANYRES32=r8, @ANYBLOB, @ANYRES32=r10, @ANYBLOB="08000600", @ANYRES32=0xee01, @ANYBLOB="08000400", @ANYRES32=r11, @ANYBLOB="10000400000000002000020000000000"], 0x54, 0x2) [ 2481.118119] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2481.161758] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2481.214032] ubi0: attaching mtd0 [ 2481.218451] ubi0: scanning is finished [ 2481.251894] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 21:56:17 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x0, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8010) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r1) [ 2481.304644] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2481.333884] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2481.340659] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2481.357362] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2481.366413] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2481.373406] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2481.389119] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2481.410623] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2481.452785] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2481.474576] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 [ 2481.494319] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2481.503552] ubi0: background thread "ubi_bgt0d" started, PID 16819 [ 2481.524319] ubi0: detaching mtd0 [ 2481.538770] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16773 comm=syz-executor.3 21:56:17 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f0000000180)={0xc, 0x8}, 0x10) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r1) [ 2481.554831] ubi0: mtd0 is detached 21:56:17 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_setup(0x80000000, &(0x7f0000000040)=0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) io_submit(r1, 0x3, &(0x7f0000000340)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x80, r5, &(0x7f0000000100)="d9b12d5d506317a8cd36c8b02b27f0a884e85a97e12371f9064a54859e77ade21e1691b0886eec269abe49d79aee2fb0688a571e2e9c8a9a05e95ca1a318da742a5f3042b30498ad23559d5ba6bce9e43b6aa427527a34ee108812ca", 0x5c, 0x0, 0x0, 0x1}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0xd00c, r2, &(0x7f00000001c0)="b493f3aa9a3b4182849a4683088f8bd1102b512b331b3679d86627311ad8363596292b7f634a07869f46add3a0c4d03411f3e8b2bd232a229937120c51d2ed90adeb4b8b7e952158996035932f3254850341dd", 0x53, 0x3, 0x0, 0x2, r3}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000280)="2009a9fbdc7341200b1518ec13d6c143470e778bd7823890a6fad1b1c8c907c8b3b6a3", 0x23, 0x0, 0x0, 0x0, r4}]) socket(0xa, 0x80000, 0x6) 21:56:17 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) 21:56:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:18 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$NLBL_CALIPSO_C_LIST(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x4000000) close(r0) [ 2481.685479] ubi0: attaching mtd0 [ 2481.690064] ubi0: scanning is finished [ 2481.832737] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2481.860096] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 21:56:18 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x101800, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) readahead(r1, 0x7fff, 0x3) fsetxattr$security_capability(r0, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0x3, 0x7b}, {0xfffffff7, 0xc5d}]}, 0x14, 0x2) close(r0) [ 2481.898660] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2481.931872] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2481.960314] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2481.983258] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2482.013735] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2482.052583] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:18 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000000)=0x200, 0x8) 21:56:18 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000000)=""/84) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2482.087632] ubi0: background thread "ubi_bgt0d" started, PID 16853 [ 2482.094063] ubi0: detaching mtd0 [ 2482.121927] ubi0: mtd0 is detached 21:56:18 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) 21:56:18 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000)=0x8, 0x4) [ 2482.232772] ubi0: attaching mtd0 [ 2482.250069] ubi0: scanning is finished 21:56:18 executing program 0: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000006040)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)=""/8, 0x8}, {&(0x7f0000000340)=""/145, 0x91}], 0x2, &(0x7f0000000480)=""/141, 0x8d}, 0x80000000}, {{0x0, 0x0, &(0x7f0000000600), 0x0, &(0x7f00000007c0)=""/93, 0x5d}, 0xc}, {{0x0, 0x0, 0x0}, 0x8001}, {{&(0x7f0000005f40)=@generic, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000600)=""/179, 0xb3}, {&(0x7f00000006c0)=""/223, 0xdf}, {&(0x7f0000002d40)=""/4098, 0x1002}], 0x3}, 0x1}], 0x4, 0x40000100, 0x0) write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f0000000100)={0x7, 0x4d, 0x2}, 0x7) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000980)={[], 0x101, 0xffff, 0xff, 0x0, 0x4, 0x0, 0x3000}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f57b007557964653d3030303030303030303030303030307030203030d04829f0757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) ioctl$RTC_UIE_OFF(0xffffffffffffffff, 0x7004) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x201100, 0x0) close(r5) socket$inet6(0xa, 0x3, 0x7) [ 2482.386427] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2482.404439] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2482.440929] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2482.468258] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2482.491594] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2482.511977] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2482.531019] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 21:56:18 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f00000009c0)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={&(0x7f00000004c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010600000000000000400200000014000200697030677265746170300000000000000900010073790900000000004397a67fb387d410d97777d1b7ea18ba8eb1f0a6d5bf378fe944d0513b7c1ecaaea9b9548d4c52e71d31bd5a9b73783dd45b7ada1081001ae11d1a7afde82051388ddade9665007e89c98657089fa82b8c092e2eb877b382cb0d712235d22f7f4e3122d4e8959aea3706a5637af3317d5516382ea4f3cf096a9db4f7057fd38959c1189891deb0db741f98f324e3e6b9a953cf0818b2835a29e2859708888e2413a0422c016f0da0eb346505cc1b6234a0f66e4d9d0bb3be6a867cbabdec33972b9c48ec4facb9c0ddbb49f70491c93b9ccd6de1f810717be42e620bf7172f26f34fc112a1f1c1b85510650aa7a2cc980f366c0100d7790120914d"], 0x34}}, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000325017000ffdbdf25010000000900010073797a30000000000900030073797a3100000000140002006e6574706369300000000000000000000900010073797a3200000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4084}, 0x90) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r4, &(0x7f0000000040), 0xff66}]) [ 2482.561637] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2482.593674] ubi0: background thread "ubi_bgt0d" started, PID 16891 [ 2482.600563] ubi0: detaching mtd0 21:56:18 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2482.609032] ubi0: mtd0 is detached 21:56:18 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2482.700868] ubi0: attaching mtd0 [ 2482.714103] ubi0: scanning is finished 21:56:19 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x8000, 0x3f, 0x1, 0xc4}, {0xfff, 0x20, 0x5, 0x6}, {0x0, 0x1, 0x3, 0x7}, {0x3, 0x5, 0x58, 0x2}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) ioctl$SIOCPNADDRESOURCE(0xffffffffffffffff, 0x89e0, &(0x7f0000000080)=0x16) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2482.853486] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2482.880618] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2482.922470] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2482.947795] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2482.971726] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2482.989535] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2483.023969] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2483.051628] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2483.073933] ubi0: background thread "ubi_bgt0d" started, PID 16920 [ 2483.080450] ubi0: detaching mtd0 [ 2483.094750] ubi0: mtd0 is detached 21:56:19 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) [ 2483.208907] ubi0: attaching mtd0 [ 2483.238583] ubi0: scanning is finished [ 2483.408025] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2483.426800] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2483.446684] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2483.472626] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2483.493762] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:19 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000000)) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x28000, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x10, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x1400c045) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r3, 0x400, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4005}, 0x4) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) [ 2483.521243] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2483.543250] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2483.559497] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2483.575204] ubi0: background thread "ubi_bgt0d" started, PID 16946 [ 2483.581665] ubi0: detaching mtd0 [ 2483.592120] ubi0: mtd0 is detached 21:56:19 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) 21:56:19 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x8200, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x800) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x41c000) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2c, &(0x7f0000000380)={0x2, {{0xa, 0x4e23, 0x7ff, @local, 0x8001}}, {{0xa, 0x4e23, 0x80000001, @private2, 0x10000}}}, 0x108) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r0, 0xffffffffffffffff, 0xf}, 0x10) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x4c4, {0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0xa0) close(r2) 21:56:20 executing program 5: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x802}}, 0xa0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000080)={0xfffffff, 0xfff, 0xb98d, r2, 0x0, &(0x7f0000000040)={0xa00905, 0x5, [], @p_u8=&(0x7f0000000000)=0x80}}) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) io_setup(0x1, &(0x7f0000000300)=0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) r8 = dup2(r6, r7) keyctl$dh_compute(0x17, &(0x7f0000000000), &(0x7f0000000700)=""/243, 0x356, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x02\x00\x00\x00\x0f\x00@\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, &(0x7f0000000180)}) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="b0a91f1890730854bef800eea3485666055614663314b78c0ed6a1b7c5265a858edb536645723bc3ae6fcaea0f8656c74ad164779036b8f4a6732de4184387d09f91a6e67ae715ec1120c9012f0221f22bdf9475bea179fb412c97a8b6b8379976015a9cc72047718dc91f56636c81e6b0beead9c28ff19307a2704471ebe24e4a96dad59d9b98f537b385dbd4842818b06d6ca34e3c76306192c66561d1", 0x9e}, {&(0x7f00000004c0)="6f1d58546d5de1e92e03b5a21d53080877fd4e6d9e86991610216107b033fc830689e1a9031abdd2c8da913336f4c5a1c05e00512884cc600eafd76666a999dad01ccc16bf6a59ccb71ec894cc0fd6913fbe1b8a82734d7f2870", 0x5a}, {&(0x7f0000000540)="238be2c8689d6c8d5cdb67fc336a06570c8f157820190fc81ccfeafe278c98fa641e69fc0d23b385565766b41e188f4a4eb0f01dbf5581f4e24527d14625a5b1e6654845b2fbf012a4efb06702f805bbb104184178352713acbe00ec9d08926b854292a8039999230dd5ea1b3036a41ffc5ed0b2999737ed1fac1b6123bb3a2efee3c87a0625", 0x86}, {&(0x7f0000000640)="d75e17fbb9e953a1293b058ee41fa02d80e11a0288b74ccfcb3eaea6a18cccf947adfd21f5669801f5d7ee43d5b2db3cb9cae97a426fa17c37bbecc98c3bf588d5c066206d90695106f288ab3dd40224adae23ae0a74291dc7f4a9615b9337770b494dd3ca52318b7fdb87b68f07a1c302c963d9fd3c292dd8e0fe4a9d72059497c2d767f96290ebb30ac6027d1ce2423ad119dd91d8b1efe61b", 0x9a}, {&(0x7f0000000700)="de7f9f2904cd0ed7441028102affc9b0bada3e7d4e2f011423a6449057257e9524d92be30d629baf3e31f4e0d3d3daf836a4b8ac7b8df36874b65a62ae375909a930676ab600db4151e9d18b98a70f37ae51af1cac", 0x55}, {&(0x7f0000000780)="5cffa48b392319de0973b1cd1be64b324191f549b42cf1975bf743414a8cfc14fd702441bae1ec09cc348c3fa1ab1b318ad93ffbabd223644305c83b7345a6d8ad9d3177f6318a0af5fa4cc982ea3fdeaef1882cf5a5c58c1b2d88907830ab925972b79b9dcd5e48d86df85c6033fe838f9c42cd34604db0980a67d99d10b2349b8f37e5eef9df0afd6483ad30cd187b1b9032354fdd4cb83cf99faba7e4386fa9958d6eb994a8ab81379f1503abab11c7cd7691a67a8c067d634cff37b3a5743dedaa02e146ccdf6f24330b356cf796e1327dd6cf164008179826ab0b7e6fcb3662bcd7a93b714685928020a9aef8f9bf80466fda", 0xf5}, {&(0x7f0000000880)="d2c6ff5268de8d733bb6083b88a6cac3bc04a916d0cba46240abb095a8f9799ad3ecb9d99f610cf1e428f63d8e6728e2a900e7f3a94d8501cfaf743d833317141c78f38c2b3eb3ae9d101cd2a4ae6cbd8751dbb257a47b4bf7aafb022a90c8c2f815a7682ba5a57a", 0x68}, {&(0x7f0000000900)="50a7fccb04dab604e7a774ea94e5fb9cf3a02bb17de906edd97663bcb6d05e68807cdb02da7c925115d7bf0518cc9c850fd431ce92e5391d4e96aa0f881d97c7ed22186988adc4cf6011c752c9d9fb9c7ff765d17cada6e44d39b2b6203ae4946a3b07d51f3df56e954d0a7ef8a5c96c858997d6d3813327fc6e0e6a34c00e0a5dd51ab4b30eac2fe9827377d15c2215c79eabb98d28c8cd523a873fd1aaaf6662fb8f242fe871f0042077b5d18463c6323b5156859dfb82f746d1dfc709853b08ba278f9d74ffcfc73b3b114a22d908c911695f", 0xd4}], 0x8, 0x0) ioctl$PIO_FONTRESET(r8, 0x4b6d, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r4, 0x4, &(0x7f0000000d00)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r5, &(0x7f0000000dc0)="980ba99d808c046e364d458d3bf97ff7f990118389eca643760fead3170e31f5e0b729c69759a88c99624670631b84b9b280f4443a297e9055128b526325b3ae7ad0062759103399c84f38934daeb03bb3a25dd4594e15761a05006d4d8e82dd7ca635aa6a6d3f7f52bee8c963d401f7259639aeb185e81778fa71fdf99de6675face2ac404ec878b6ebf9352773cb2ab847072922a84a3bbe0f95ffd7b7330c1f6d12d333413a22b31a2303facae293d06ed5e6c2f0530c26d07516a7f531879bd13d2d695c9eb5e313f4d0f0c5a589f9a1da892c0ad5e0231fdc27f91f501b50791f5546377f0a6f51de919f1588e2aa95641a1ddf226a00003cc5ffda4f3ad1024714e5c18810f0fc6b840ad4674d1f8ec4e23e134497688665fa165212428e3b0ca2", 0x124}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x8, 0x800, r3, &(0x7f0000000f00)="92c019d58c8184bdd40ceb7fe9be8fd0218e4b8365e23e9c5bc7c9f13e4c11b3daf16617d52a23f0c3d9d74d9830fde972bc3c08d14e2bca4543eade7112ebf3595f508367e5bd153941c659f7081f8e21d4feefca29ab88247e13a1a1ec5bbf87bb39cd98a2e2fd26220266d2493983c18edca9dfd9524095ab65cd4975eba0f45760bf0da77c3a5d1705f03fdc107bd7285b7aaae531b39800"/174, 0xae, 0xc510, 0x0, 0x3, r0}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x5, 0x7, 0xffffffffffffffff, &(0x7f0000000b40)="067dc682b56a5d68818d48e7fe0784af50d3e294edf8e3eae747c418ff1052806407b8b6307c27d24b11245f83c5a63894b85c086639c2f11bbfc3778164b43b787acf13b01a8aefbf561ca96f1134f8b47d", 0x52, 0x6, 0x0, 0x1}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x6, 0x400, 0xffffffffffffffff, &(0x7f0000000bc0)="859e7f8effdc998350a8eb0ed39457606feb3a23847859b43cb1c95bad1d64156fa1cdf853241d4c2e940fef3a6c1880a581a9c6c2dbe2469138ab4895468b2835ce22c0316a9f5a82affe1a689ad733483e0317fecc74ccdba67e2ff08d52131fe8d7531781a7f79879c04fa870de167e22798eb9cb8ebe71cc0a26a7392cb1bd09dd6d03901d50ef2f52ccee7e529da54e8750f782f8344a722d9226e114ad7387f613e086bc7823b55782c09b03ce4adc76838857cb436ae3ea02454dde7964b9451b013df213842ab166e0ea19e64dff7bc1e779140fce7e9b1fd0b2ebc41a71598cf74f60", 0xe7, 0x13f, 0x0, 0x2}]) [ 2483.720701] ubi0: attaching mtd0 [ 2483.725192] ubi0: scanning is finished [ 2483.818183] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2483.827001] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2483.832931] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2483.841890] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2483.850951] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2483.932845] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2483.946483] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2483.968691] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 21:56:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ptmx\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$PPPOEIOCDFWD(0xffffffffffffffff, 0xb101, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f0000000280)={0xa0, 0x19, 0x0, {0x1500, {}, 0xc9, 0x0, 0x0, 0x1, 0x5f1, 0x0, 0x7, 0x1, 0x2, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x20000000}}, 0xa0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[{}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000180)={r4}) ioctl$DRM_IOCTL_RM_CTX(r3, 0xc0086421, &(0x7f0000000080)={r4, 0x1}) r5 = socket$unix(0x1, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0x15) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x2424, {0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x100000000000000, 0x0, 0xffffffffffffffff, 0x0, 0x80000000000000, 0x9, 0x3, 0x0, 0x4}}, 0xa0) ioctl$KVM_SIGNAL_MSI(r7, 0x4020aea5, &(0x7f0000000200)={0x13000, 0x113003, 0xfffffff7, 0xff, 0x401}) [ 2483.989584] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2484.015251] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:20 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) pipe2$9p(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) close(r2) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$LOOP_SET_FD(r0, 0x4c00, r3) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000000000)={{0x24, 0x1f}, 'port0\x00', 0x24, 0x62, 0x1, 0x5, 0xffff, 0x9, 0x7f, 0x0, 0x3, 0x9}) [ 2484.040110] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2484.071174] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2484.106206] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2484.142716] ubi0: background thread "ubi_bgt0d" started, PID 16969 [ 2484.144542] could not allocate digest TFM handle æeHE²ûð¤ï°gø»±Ax5'¬¾ 21:56:20 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) [ 2484.150520] ubi0: detaching mtd0 [ 2484.192955] ubi0: mtd0 is detached [ 2484.200795] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2484.209974] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2484.215939] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2484.224851] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2484.233757] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2484.262557] ubi0: attaching mtd0 21:56:20 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x1000, r1, &(0x7f0000000040)="13db65979cc798ea8a942fc1c519fd19e3", 0x11, 0x8001}]) [ 2484.285223] ubi0: scanning is finished 21:56:20 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 21:56:20 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2484.486119] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2484.506031] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2484.511383] sd 0:0:1:0: [sg0] tag#2950 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2484.521795] sd 0:0:1:0: [sg0] tag#2950 CDB: Read Block Limits [ 2484.527898] sd 0:0:1:0: [sg0] tag#2950 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2484.536853] sd 0:0:1:0: [sg0] tag#2950 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2484.545796] sd 0:0:1:0: [sg0] tag#2950 CDB[20]: 9c 09 3f f0 09 [ 2484.551232] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2484.573047] ubi0: VID header offset: 64 (aligned 64), data offset: 128 21:56:20 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0x4}]) [ 2484.592224] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2484.629733] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2484.654355] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2484.685827] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2484.707775] ubi0: background thread "ubi_bgt0d" started, PID 17012 [ 2484.716143] ubi0: detaching mtd0 [ 2484.728651] ubi0: mtd0 is detached 21:56:21 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) syz_open_dev$tty20(0xc, 0x4, 0x1) [ 2484.750523] ubi0: attaching mtd0 [ 2484.755767] ubi0: scanning is finished 21:56:21 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) 21:56:21 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x4000, 0x0) close(r0) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x1000, 0x10040) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r1, &(0x7f0000000100)="c1cfe0d0757d2fc0980bb0797b43923570143ee19fdd9730f6bf7df3a7a5985e88921b160c5ea263334243b09b4e12413c4e4469d83acb66602a9d2d0fc7ba40d5582ab33ffc0d5b3fd875494b4009916b8119d9039ac6fa9905ae6c255b5ec2c4435412708add585a6ce9a49b362eb289cd72c46d9048920f9c3c950f001b2152217b682d08", &(0x7f00000001c0)=""/237}, 0x20) openat$mice(0xffffffffffffff9c, &(0x7f0000000040)='/dev/input/mice\x00', 0x20000) 21:56:21 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, &(0x7f0000000000)="a94c2ac10c4867d360eb4951afe72a2ad370d5287c8f1b22edfdf1b8f2858c78cb1bfc3ccf2ad72384274d843c6aaeff46911ec25e69536fb3cd4cbb2406a4ace96d5509d0ec440635f1ef1f5f655e6f6280ee122f5d81a8498dccfc2b510cefb99f0086d37061213712de40674dfe400bb11b1967e1878e42b27def495d6aea0a3b38623974b43b3d310a5576c0d2d5f4cff2e5cee156372d38afc1a5be4e66fe5511b077c7c150960140") r5 = accept$nfc_llcp(r3, &(0x7f0000000200), &(0x7f0000000280)=0x60) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000002c0)={r5}) [ 2484.960777] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2484.982410] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2485.005372] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2485.037013] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2485.074982] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2485.102758] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2485.138912] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2485.163505] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2485.172835] ubi0: background thread "ubi_bgt0d" started, PID 17048 [ 2485.172843] ubi0: detaching mtd0 [ 2485.197126] ubi0: mtd0 is detached [ 2485.200786] ubi0: attaching mtd0 [ 2485.206522] ubi0: scanning is finished 21:56:21 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 21:56:21 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x1c3680, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000080)={0x9c0000, 0x8, 0x7, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x990967, 0xa18b, [], @value=0x2}}) 21:56:21 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) syz_open_procfs(0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r1) [ 2485.344031] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2485.363699] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2485.387776] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 21:56:21 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x280b42, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x2}) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x6) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) fdatasync(r3) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000280)={&(0x7f0000000000)="9017e961a9485efc1a43a1be6230cf537fabf69b5de604bb92069a443e5e0294da823765029c43504d103a3dee80bb6943db9f8beb2b6854938c24082b4bf38de2b99caee4ec536edb5ebb42f9e34fff084e0227d25f22851fde473075756b1e20", &(0x7f00000001c0)=""/105, &(0x7f0000000340)="bce8478667dee08c34ea633ca4f43574eee4d0b9d7f8dc00c50753f583faec3866be5be0ed65b667ac9d480c7059b4d207c89cd482879a13a54ebd4069895bda88f0d9d54824793a307cf67a34c2b580a3df9e3e3354c0377f77e490c14a8bc79647f7ca97427ff11df3d5e30ef7443ef7bc00e58b0ee7212075e4e5ac0012b07152368710dd594e2110c4d11cb1fe6576226af57c3e7f6cd9f3b7a19128d51f494bf4c1ca0f51881a", &(0x7f00000004c0)="87997e34c783c39992c789125f5296979007e8711b25f709a28c32a6128c5173a871f34a907eb74027f6080ce54f785538856f0fb52d9f95f5793dd759806d1cd87fd344fd07206f6c64eecbf82db513d9bd2e4a496bd40340c40ddda09ef9e6f79638a4df79675309bf850cb24e526bc444b08ef67035906f8161738f68793445189dedf0", 0x10001, r2}, 0x38) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0xc080661a, &(0x7f0000000400)={{0x4, 0x0, @identifier="33e0864d275e21d5afafe9e5ef7a6828"}}) prctl$PR_MCE_KILL_GET(0x22) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x40, 0x8000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xecf, 0xfffffffffffffffc, 0x0, 0x0, 0x1, 0x8, 0x0, 0x0, 0x0, 0x2000}}, 0xa0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0xffff, r2, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x3, r2}]) 21:56:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2485.416118] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2485.445151] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2485.470770] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2485.502509] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2485.537394] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2485.567086] ubi0: background thread "ubi_bgt0d" started, PID 17080 [ 2485.575533] ubi0: detaching mtd0 21:56:21 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r2, 0xc0506617, &(0x7f0000000180)={{0x4, 0x0, @descriptor="7c4424d19a37be1f"}}) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200)='ethtool\x00') r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r8, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r8, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x60, r4, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_LINKSTATE_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpeername$inet(r1, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000040)=0x10) [ 2485.587451] ubi0: mtd0 is detached [ 2485.600516] ubi0: attaching mtd0 [ 2485.612237] ubi0: scanning is finished 21:56:22 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) [ 2485.800059] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2485.819721] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes 21:56:22 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r3 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000500)={'syz'}, 0x0, 0x0, r2) add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000900)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228897501f93191b076ac446ff0022b8753a1fa74ff569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23", 0x395, r3) add_key(&(0x7f0000000040)='.dead\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)="4c92e11dbb733997291403826af641e3f87a67ffa416d526cd92ed10396f602396baf8683c928113568784054c6e2cec5286c4ffa797ac93304c53cd9e851bec4253be81558ea8723015101549c7a99cb21df2b59e109e8b62f28e2f2920870a6fa4bbe6b7119ecb7f1b76307631d1a5e7", 0x71, r3) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) r6 = dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) setsockopt$ax25_int(r6, 0x101, 0x5, &(0x7f00000002c0)=0xfffffff9, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000240)={r7, 0x800, 0x6c, "9fd8e4613c894b7c21849c2f6ba51c17eb3165687ca1ce617714793cacf0bb9fe203fa5ecf2a3398eed474c27789ab44445c89e4f8894e2f8d691606edeffe046cbc4bd2ef03fcbd1cbe4e951ada0a42917a2adcb3425fca16130779c2d1d34b8eea18ac5bc03dc393729bc8"}, 0x74) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x1, 0x4) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2485.853498] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2485.876536] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2485.914418] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2485.933158] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2485.955170] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2485.987356] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2486.018660] ubi0: background thread "ubi_bgt0d" started, PID 17111 [ 2486.025203] ubi0: detaching mtd0 [ 2486.034049] ubi0: mtd0 is detached 21:56:22 executing program 0: r0 = semget$private(0x0, 0x4, 0x0) semctl$GETVAL(r0, 0x0, 0xc, 0x0) semctl$SEM_INFO(r0, 0x1, 0x13, &(0x7f0000000140)=""/237) r1 = socket(0x26, 0x5, 0x5b) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="0471c4ff6f6a7c65d1e947ead05af87d9407244f8cb1055337d2e2baf9e1156402fd90a66718f331ecbc3845e70de7cd135fed1297fbcef3c299f06bf43e02be8ec3d551893476eca9e18ed544d2b5b28596e33027aea04f5d2a5e103aeb78af64d9c73b67b0cbdc623e954a947c0a5401e52bc1891690ba636db155b18792d4f7e89acadebb879f4ddb3573ff7284c24cda70465ecf1a3e0d20871fcdbece54b14fc531203a08cadbb6fbc129133fa17e05f923b8dc2af43b0f401787f464f3102e", 0xc2) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x404080, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$TUNSETPERSIST(r3, 0x400454cb, 0x1) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000100)=0x91fc, 0x4) close(r2) [ 2486.047148] ubi0: attaching mtd0 [ 2486.052007] ubi0: scanning is finished 21:56:22 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) socket$netlink(0x10, 0x3, 0x0) 21:56:22 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000000), &(0x7f0000000040)=0x40) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r1) [ 2486.255290] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2486.276672] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2486.292360] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2486.307877] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2486.336016] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:22 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x0, &(0x7f0000000000)) 21:56:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2486.359548] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2486.396944] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2486.429864] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2486.463769] ubi0: background thread "ubi_bgt0d" started, PID 17148 [ 2486.470228] ubi0: detaching mtd0 [ 2486.476917] ubi0: mtd0 is detached [ 2486.482863] ubi0: attaching mtd0 [ 2486.489065] ubi0: scanning is finished [ 2486.517107] selinux_nlmsg_perm: 422 callbacks suppressed [ 2486.517123] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 21:56:22 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) 21:56:22 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1000000}}, 0xa0) connect(r0, &(0x7f0000000000)=@sco={0x1f, @none}, 0x80) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r2, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') sendmsg$NL80211_CMD_GET_KEY(r2, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000600)={0x4c, r3, 0x400, 0x0, 0x0, {}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, @NL80211_ATTR_MAC={0xa, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}, 0x4c}}, 0x20040050) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005e7ffffff000000000000000000", @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xfff3}, {}, {0x8}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_GET_INTERFACE(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r3, 0x412, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x48085) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r8, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000080)=[0x0, 0x0, 0x0], 0x3}) [ 2486.608591] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2486.626366] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2486.650046] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2486.686878] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2486.689007] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2486.713718] ubi0: VID header offset: 64 (aligned 64), data offset: 128 21:56:23 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = semget$private(0x0, 0x4, 0x0) semctl$GETVAL(r2, 0x0, 0xc, 0x0) semop(r2, &(0x7f0000000040)=[{0x2, 0x0, 0x800}, {0x0, 0x1000, 0x1000}], 0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000080)) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) bind$bt_sco(r4, &(0x7f0000000000), 0x8) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r4, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x48, 0x140c, 0x20, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x20000004) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2486.744529] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2486.769991] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2486.802400] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2486.821507] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2486.832160] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2486.877591] ubi0: background thread "ubi_bgt0d" started, PID 17174 [ 2486.884312] ubi0: detaching mtd0 [ 2486.902887] ubi0: mtd0 is detached [ 2486.914419] ubi0: attaching mtd0 [ 2486.918833] ubi0: scanning is finished 21:56:23 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) 21:56:23 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) vmsplice(r3, &(0x7f0000002300), 0x0, 0x1) vmsplice(r2, &(0x7f00000022c0)=[{&(0x7f0000001040)="35aff0ae254b26a826030f7994381244ddeacec3808aabd096c1688a5060f88d8357f6497b6084997df822ce794e667da47d2e24206cd0728788f287a05a486863f0b0a0fcad3a12ca7cb113491b4ebcee2545b2ababedbf6d81bbba5763b14f1c63e475e2b52a37b424a8c6a34fc1", 0x6f}, {&(0x7f00000010c0)="dc48dd2764038d9f5cd1cb4786122fe347fd517b70b90992bf741ba0c619ab80fc1c137d6d60c92067288ceba056880ab2aab5851a14cd08df3adfefd62e2415164b4e67cdf343725de9f4bb814fb498689b23dee66cf7c2124b250d459f99e8c2cc87b1d51411322f163608ce24ba3f42c345eed6a07f0463f3444637adc02e0d8affe9117ae359420a7d3e4ea4c9e2df035b380c801789429801f2abddf3299b96e79ba04f9bdd261ea6d7dbb284c6cda848ce429a182f5dcece65352a7c975f26685118e02baa1066a5c91927c78622ca916a48d0b7e88e7c28baad6df503b362571cfd0f124052c4912c9e2c1c803b1a143d268435c0d9e60b98be98e747b6ada89a74e82249283a9aac2d29df26f4da3202ccd196760d67efb324b273cdb8c98a3be003b98105f6ce088ab2511a29540adf48ff5deeedab0751fcb397223e9d2b0354d13490aa1128630f51b99e0abf8e954b9326189a363c44a88f6a533c77e3d1a0eea4b78137d95540522cc5abcaa98866ab08cd83028d035ad80922119291aaf9d7c4773c8d9569d9ee6f5791e928af69246a8416fe24c24ada47a67aed8cfca2054d6440900c5d25b918ffd0f84ffa402514a22ad8295f2facb0af1ff70328e994df497175b94b020bd3739a725003c98d95a53af74485e66493575902c9b822c41b826bc0b0112ae31ce5b1d9ae7ec4241222bae7fca4717b17eb44bba5c00ebd459e4a2946042642f0dd91320e2c34f2e14518a288002ad2a60d4b14470275545988feadc1371b88a2236db477c54daa806b954f111cc479d897ccd400f89fb58018a8440eb9a119167b982153553a08f5dc564e60e917d63996e7e8e6f399d83283e9657dc356d772b1518df2548ba981632b9dd89f6febd328e2be4816e82fcb6ff510ed2e5ae2e3bccdc617abbec6e0a3b11b7d6b97fe0485a2df51f5a2ac97c86d0bb9a511fe72af429dcb736899c760b0659d51fdbfa2dacc57a9240e515843b961e1f784e9ecf27364e6dac86998423db5bbf0f8c239e1fe9a5b617eade7d7afb8359229b046735ab43bd6393a4e5d1b6db25bef1d0cb77c99754ecd6001394060bed856f641e4938c8ae75a26eca36c198e7c2fa3d95004fa83260d5f9cf2acbe6ca128f158c9d7dd7f8fd22d3ce80427686fa5108c5685c5d175d460ebd22f277baf49e1fa13b1e112267cd47559feb4ddcd528960cd2940bbc83e5d521e16f1fb8e12f6fc2e7019eab2c42f4f40ead918a275c9a52b7bdbc9d257452b865afaa56352c106fd7ded9d9015451db91afd62e9e1f104225af9c96c7df3578bb4da7f8cbc519c0e4430759c89c9c431feaa4f61357c52af26256f6b620c51499889bbdea429854da475e00fd0171fdc4647653bd08d0cfd85040fdfb28ce0d5cfd21e94de6819cbca2649c586e832fdd6d37a806c7056c160e7b1dddb879e8eed27cad815071dddb0cb93b574e1022c126ac0ed8407a560dc97b5737b39705e1825649087021674c254fe4db4a204d6e9f0435206bc48b1cca195a153edafa7a8b4389252c2f63d3033439699e782a5b92ccbed2b60cc3ecf56a120e3c273c08345b8040f4366f2ff376defba20a36ac09ef22560b9044743b81b60061eb84dedab10342b18ec12e0f3a1167cd8b0c0d56c176adc2a58d2d17de53c45965dc5fd28b70403f86d9c43ad4f047472cfaeda15c39762f6e783f62b230e74bb4cae977c6ea539a72ea33d1879fb15e4707de670282ac97752670bec8cc93f9b8615ec3375bf1db349d9c39db0cea6932f92f04c3eb593e3eebcab1b1cec711db1a00890798c7fdf1f985f2c5b1977a3e74ff38b78c898b7e2ea3559f0a207cc25bb8df36144d770fa18c5c2717edd147bae13d4165d53c1e3140e1eb67cfa9b7ab48e1f836c024d2fa3660777cfdca24bcb155b1028b05f7972d6a58210f69b21c305780422e36c445fcb593efb46d066e0d912c1e8a7e9936bed825e7b4f56124f292c401a17b882db24c247ee8d4206bd74561bb645b76f72d8b168757767abe0e7511c604bd63d09b4e4a36211baf05c79dbf60a8d64c697ddff758d61c790e5a0d5a3d68e5f24579ce1dde83ec3fc3687b01fe46fded3a97f06ead140416acb778cd47aeccf75cf54a97da20e5c55a1124f1d57b122d5a4d28d092dc1fd1fe46c70d9fa062ff133ed21b8a5b5364fb04b57f1ae08d28f45bece98bd26c8ec7fd8af691cf11d0587601569c0b926a96b03f22f31d1e36d801dd4a2240bbeea4b803169f5c56d8dad3a58e33c652d98508809a0efdc580e908a17e553567b3039f2e0332530ce3c293e6a5bf7f2f9c7342dc566892a88cd20f680cdba34b72e7e063da349eabd5d56bfebd0121d542dfb3f6c7e46d65f6a4e7dba649bdb3deaaf72ade86e783bf59fa61b48015df90d640cb33e47c017140c6055048725847a74a232e0054df356c6cf4bee2fae0431508492fa049092a66810b841e306f611e9e298e54afc5cf1b39c211d67a9f00140378ef7b0a544a2474d3ae5c2386c2253caca53204f1ebf185121917ea090acf9f930073bf1eeb3e85e112f2c6102e4e62cb9fd2b563676cc5e38c9ada19745d3f001da339443841074ecdea85c403b959f78b14de51bbd311dcea248b73b50db98bfe7fcd8b42938c95644555917cda1e001951fcffcf16dbce6315cf63dca24c46ba8cbdc12b971832f0c62c417b554278f0a3df925a192e368ffaacfb06542531c9bf60bcdd26c757568caae9808bb1bc2d881940503d056f589403d2608000a82d599cdf2aecc45282c3f9c7fbc12dd11d621b30577e0669f514b588b645486641b87eee15e43492dc63e86c0545b7dc5ad11bc126ecb2a57a6cf260cb38540fe4e2a026bceca65059794cf54d0e99253ef4387e24e562bf09cf77d29c99c2ec0d4e08415b69d18c7aff34530764cce9d07959b164550ca3bf96ef05d396b974c9e6c0a2ae0f6d2490909ee0c62bd60c47cc6030a13d9baf18eed04b1e14ee4bccf636fbac090be26fc6446d71fbd4b71baee2ccae7175981fbfa8ba8c718f9d2b09ef15e42af3c54a35825e2bda3d32d8899e9e2991987ecf0c6886d83b84756c1dc2167a5be67858d0a68b9fbe674bc116164987b0cc458b1cef747e991c4bbb2b5d9a3968ee83b48dfbb6e5ffbe03da705680a1ced36a0201e3864b3ead8439a00aa80256e6133598502870a6b9129ad05454b371e2f1940e492b3bc93c7fb0c84712761eb868ef3810c11bb2532296cc766f70b74e5ad07f48edcb9dd9dd09baf5a9cefafac2f78c17bf89d6bce0ec521d3dbdb85e807f75df87781fbdfc9a19727427e56080c1fff6401471c037c979ac8fcdd7d17efb1b3faf04d994c5775210aa55160139fb3c7592704ab1838dd1f812fd312b150a59cf4f3d019ee52adabdcdfb3462889ae5cfd6f8ff3d2f6fe07d4682ba0e8050245ef6bb6aea5ae611ddd6df20e0665954d06c4032231f9a3a6f8df98c28d0acd4446b99493a55cb8ea158dd0456308ad0be5c5e8c9935ada82b1cb10527419983e1d8592246788098418217c9f1c4302e436eeb8db79e38193254b1309d660de293568c95d872d1fb8d317b7ad9397e4ee7c9b6fd755a07ca08a74f8b8e110cf31a81511c6a808c23ab914c3509d11eda3734aef97ee73f24eb4d27c554efd7bd04ce04c23cfe996b303321e24b3af457d1e4cd2ffc08ddb5ea9950da9adaedb460c1887871a52a7990697c64382ae838008cadadfed3b9afc0458fc7c51b09731f123c3336bec18623538ccebd96143eacd6b3f9fb6f5e848c1222f7d8221f79fb936da274070630831b55efdeaf20ff1525128167221746427f147adff945399fee712e8df015c1360b86f57e9896e141b6576df055f4ae5b4fda42ac75e0338b4acdee19c43f8cce1f37b4da71872be21db296652ef22f266b23a038c0d098b51baa700313abfa3fbcb0a7a8e646b46e2314e3d19998e83514f247c054566dc35652c3492085556432003e0f329ef8a9f0810f1034f0e2b45d502f9f0bd3025072735c7da88749dcfda40dd88a8837d58574cde4c7defdcff3a504e3ef393d831dae099facc114c850b819437a130e857c83ebab087190d90110cabf189a3115cc2a777b088ebf598f407a8acca7113298e8e9242310eeb3e11bdb5f2d1bf3c614f661f68578c108a4079388aa1215ca00053dea4d70b2c040f3275ed9ba50ae29feb756de8437f0a79515a4db35cacc103932a20bc20de4334ca21a78e256307ec7e6432b20b27c46843ccb375bb00a844a0b1d89a4acd340c946353aa5e6129d789ce14b30d006059c04069215a0f4f54dcd8f9d5e1b782938e97845ca9b10076c4f499d284a31121948785b3514ba11e2fbf8e6d8a0722547377fa8c680d10312d77790dd4264cc1751e3cf3a26714c002aeab5c1c9ae8e3e3173e67d1b8e621b4d30b6c35c2f3b7e7e4e522e11073a0b13539776d9bc17dc362a407d2d9fd688ee6c273c2d3225462a9bdde2d165c4b5996eaa3d79fc7154956a6279bbef475b25e7cd9e5111e5c357065384fdd88344e27ac44b636a598e926e665e82e7527886d314b7011c3cb52b523711baed4bc7fd9b008e448d706f5a30ae4e44dd08437ff17381f5516101fa482eb78f2ce478c355a1bfbcd4af4e5c5eeaa157537836be0213ba37c8292097e55629cb0b352edfcef881735f1a706bfd5bcbb59f7613cbbd956e9426ff1eb7720f271c5177756ca53e4b738a0b64c5be688ec06f87fffcc03873a6bfa9ea11b8f6c4a89e839987f679cff3ad887c5022b457ef321bbc134e96aff1765f35d727baaaeb4ea345ece6d99f087111733ed2a4bfe17769fd4443e8fceb0bcc45eb78c949171e20d5a9236d09e07a9244d5367ee04353d9213341e5e40a77a08f3d2fe29a5f3154053ffdb6bb5e54c6faa7463f91080b768ce49f4be913b41272d21c8174d3ff7b3e138f54b580123cf77443fc68278717c3330629bfe7d3cdfafa26d7cf70ddc5e167a3025245d66d3c612754227da423567f58ce62b860dc32c70671006b5768a610fb82d67a88bb508f619fb6d7e509fc75be4330721ae4302537332697c5d8a8b5c78f9342c7639139206455678b196db897d5f0c7ca0e483ffd1a189944a9930d7674e546e788e01f4c5edce73617107ac32759c5f9398c82e248655cd48fd93ba0acb2181aaf38ae2cf245bae2aaf28f7a0f13d02a8a69fb9a17b979f35a55f62b2c896f1052f3c5843f4a1a1a30f85d49f0af7eac91e438a460a5518f63f41be903af8298a5e1f3239d0e28b14ca135f6c112ea99c3453909645098320699e08c0615a52b90589d1289af14ba8859aa4abb71e7b55867934226ddddfc3ca121ed33a3bc693863655ca083beb838fbd9253153742ba9c442b4bc41fb00f905c1339431cd11ef7ea13d64f3e7bddfef8935b283f2b73de6a2b6734aa413bd0797864c97bdf28a4e60d37578039009489a295974f4b3d96de967e7f3824bf3dcb36a4782c567086aa72aae616c018b67a52130acad701810d5757619e81c64f6df7354aab8d069a589debe0df4c2f85b96c10f30d9073966baad540e9732581797cdc582adeb8f40285418e82901f357263e9ec34918fa74accc58d7e8ada3b8fed709f45d0718e216fd0c5fd77d3b7742a298f515e1ce8d19adce784ccc0729881f85c9840c1d0227edc945d7f23f5aedd978f12161717bc1566ba0cd3580318d17549bec79fa3d9e12227a21b72d7ff317c13e1b5ce865835", 0x1000}, {&(0x7f00000020c0)="512bd78f98fe08fa84b16510a8245b44d719ddd951d2ca7e5ef84b18b22b248f352fbf36eddeb32a62fbea22a9f2eaac1cbe6e00db146247b7bfd747538a2f655c98170ebac8b9f5b51e03a953d8a65a7a592632581ccfff391a9df71182b19c8c4a7ac6327f7bb2568c09782653c4e0ef218daa522a3c6c59d009eecbd0545c3cd7bae23166452083ca862971f02bb99b09010af6dbe8d4cbc23bf4d326ca22cc29500cd9b13e5bac20909c0fba9301dffce1e7c2630cfed9683abd45f52693467566727ef54a11fc52a6caa0bf3896af7be96a3973355e41e66089c3fa74349225825860a62e8018455470000a075bafe3ded7b8dc6c3488e6e3", 0xfb}, {&(0x7f00000021c0)="783f995bb3968f6b753c6c14edb8920560fb101c3f36fba92cb197b905f6a6ed2dde6540b8e59ab32c1d3863821d414d1c6f38bbca63e1a4fc2f80e8741e4516cfca70e7d18cd3155029da3df52c115cc51ae9ec55a962cf00fbaf52632ef418f756690bb63a6b9b39a11d3105b1cd61c12d798b420d215bbea62534f635e05bfe061bbf9a060f1ca51c94feb7162523508e5dd0615d77c9b5905d1aa91da7f1294f78d8d437af6f083f45526cad9eba3d8a3b82a3a320e37c155d2e2de8f3715815c72e6ad81c0c0e9a0573c1d8a925d473c2cb2ed3837103db8592bd519fe1a8abbb31f46546929d1317", 0xeb}], 0x4, 0xb) getsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000000)=""/4096, &(0x7f0000001000)=0x1000) [ 2486.952718] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2487.045717] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2487.054884] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2487.060850] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2487.069841] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2487.078805] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2487.085482] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2487.104092] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) 21:56:23 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) flistxattr(r2, &(0x7f0000000640)=""/4096, 0x1000) restart_syscall() openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x200240, 0x0) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000000)="7937b41ad1b4f8ac139621a2bd167c4943e266b27e6be4bb9ef8cb584ac52a3163efc1de9f0a3d37f1c19f28713751b92f60fc953dbc1efcdd9cff91239445cf4f55863bb6e6e0a99785d18fea226c10", 0x50}]) [ 2487.144398] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2487.179549] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2487.200649] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2487.218890] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2487.219690] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2487.240043] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2487.246055] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2487.255015] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2487.263954] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2487.281077] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2487.300824] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2487.316191] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2487.324953] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2487.342572] sd 0:0:1:0: [sg0] tag#2950 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2487.350988] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2487.351563] sd 0:0:1:0: [sg0] tag#2950 CDB: Read Block Limits [ 2487.366659] sd 0:0:1:0: [sg0] tag#2950 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2487.370657] ubi0: detaching mtd0 [ 2487.375576] sd 0:0:1:0: [sg0] tag#2950 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2487.387853] sd 0:0:1:0: [sg0] tag#2950 CDB[20]: 9c 09 3f f0 09 [ 2487.398304] ubi0: mtd0 is detached 21:56:23 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2487.402074] ubi0: attaching mtd0 [ 2487.407746] ubi0: scanning is finished 21:56:23 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x2c4802, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2487.489559] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2487.559787] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17167 comm=syz-executor.3 [ 2487.593402] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2487.615814] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2487.637840] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2487.660005] ubi0: VID header offset: 64 (aligned 64), data offset: 128 21:56:24 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2487.711407] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2487.733200] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 21:56:24 executing program 5: io_setup(0x4, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r2, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) prctl$PR_SVE_GET_VL(0x33, 0x14e09) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000340)="af3a7d00a17c72f5b6cefa54754ad17b4a2924b4ad88d32bec9937864ebc29c788feff8cb43438ec3a7b31314925c3d301846fe9bd50d9c92663e53075045d00591be6582425221e54173e7bb947c62a29fd70c751ac6a02215575d7f33ac8d91b6e627a4f031644371225c5840e5b5a4767376c76ef056846fce95a182c2609aa1dcdb24d2b50f1115167994baa7fc41304dfeb26cd949c0ed3434b26414ef571a38eec26cc936402dcd26c37203ed84dcfda238f2dd52743fb06a7755060f09bbba617c8c4", 0x1, 0x5d, 0x0, 0x2}]) msgget(0x2, 0x180) [ 2487.757119] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2487.778718] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:24 executing program 0: setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'btrfs.', '\x00'}, &(0x7f0000000080)='ppp0\'security@@\x00', 0x10, 0x1) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$IP_SET_OP_GET_BYINDEX(r1, 0x1, 0x53, &(0x7f00000000c0)={0x7, 0x7, 0x3}, &(0x7f0000000100)=0x28) 21:56:24 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) [ 2487.810710] ubi0: background thread "ubi_bgt0d" started, PID 17233 [ 2487.819139] ubi: mtd0 is already attached to ubi0 [ 2487.829388] ubi0: detaching mtd0 [ 2487.845437] ubi0: mtd0 is detached 21:56:24 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2487.907454] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2487.936784] ubi0: attaching mtd0 [ 2487.957367] ubi0: scanning is finished 21:56:24 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'U-', 0x1ff}, 0x16, 0x1) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) 21:56:24 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000280)="849dbf4ee46a0d55b15f3fcab4f1e605c895750084f9158ef854df9f3c9546150401574948fd5fc0964588b1254abc9ce8248fdb16cc2266ca7a9c8b2cecc0fedd2f4cfe1b9391ceea16965ed90383717c7b87501a4a5107e0efada2a5d9435fc63158d61e9eeb0bb9b8c491dfac4ae4281597b5bb040385d1ef02832911ddac24b3db9c53995511225f8bb0159bf268bcc0aa746cd1fae9a8e837f97df9330940361392c86e6e87bdae0277a83ae4b488f59f257dda5ce1042009be0aae12c9c411579781db3701613463c5fe5e8190037091c29180f77771d4b071767ba7960da54579") r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r4, 0x0, 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x80}, 0x0, 0x0, r4}}, 0xa0) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x3c) ptrace$cont(0x18, r5, 0x0, 0x0) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r5, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000080)={{0x5, 0x6, 0x10001, 0xbe8c, 'syz0\x00', 0xe7c}, 0x1, 0x400, 0x5, r5, 0x7, 0x9, 'syz1\x00', &(0x7f0000000000)=['/dev/dlm-monitor\x00', ']bdev:%\x00', '\x00', '/dev/dlm-monitor\x00', '^\xeb$vmnet0', '/dev/dlm-monitor\x00', '&keyring\x00'], 0x4e, [], [0x200, 0xb000, 0x106, 0x8]}) close(r0) [ 2488.091062] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2488.101986] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2488.116890] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2488.128751] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2488.149497] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2488.180611] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2488.218471] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2488.239750] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:24 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2488.285288] ubi0: background thread "ubi_bgt0d" started, PID 17270 [ 2488.291892] ubi: mtd0 is already attached to ubi0 [ 2488.302132] ubi0: detaching mtd0 [ 2488.315457] ubi0: mtd0 is detached 21:56:24 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x408ac3, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) close(r0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x3, 0xd8}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000180)={r2, 0x6}, 0x8) 21:56:24 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000000)={0xff, 0xfff7, 0x4, 0x6, 0x8, 0x3, 0x8, 0x3, r6}, 0x20) 21:56:24 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) [ 2488.420354] ubi0: attaching mtd0 [ 2488.437276] ubi0: scanning is finished 21:56:24 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, 0xa0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x3) modify_ldt$write2(0x11, &(0x7f0000000000)={0x8001, 0x20000800, 0x4000, 0x1, 0x1, 0x1, 0x0, 0x1}, 0x10) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x1, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1fd, 0x0, 0x0, 0x4}}, 0xa0) close(r1) 21:56:24 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2488.679781] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2488.703691] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2488.722250] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2488.745113] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2488.761799] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2488.769790] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 21:56:25 executing program 0: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x268e40, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000000)={0xff}, 0x1) close(r0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x1ff}, 0x8) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) fstat(r1, &(0x7f0000000340)) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) r5 = dup(0xffffffffffffffff) bind$pptp(r5, &(0x7f0000000200)={0x18, 0x2, {0x3, @dev={0xac, 0x14, 0x14, 0xa}}}, 0x1e) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) llistxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=""/175, 0xaf) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000080)={r6, @in={{0x2, 0x4e24, @empty}}, 0x0, 0x8, 0x3, 0x81, 0x86, 0x6, 0x5}, 0x9c) 21:56:25 executing program 5: io_setup(0x1, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_setup(0x1f, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040)}]) [ 2488.795834] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2488.818732] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2488.841792] ubi0: background thread "ubi_bgt0d" started, PID 17318 [ 2488.842973] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2488.850685] ubi0: detaching mtd0 [ 2488.874983] ubi0: mtd0 is detached 21:56:25 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) [ 2488.896805] ubi0: attaching mtd0 [ 2488.901725] ubi0: scanning is finished 21:56:25 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RUNLINKAT(r0, &(0x7f0000000000)={0x7, 0x4d, 0x2}, 0x7) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r1) [ 2489.105200] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2489.112654] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2489.128509] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 21:56:25 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0x0, 0xffffffffffffffff}]) [ 2489.157908] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2489.166884] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2489.178491] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2489.198939] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 21:56:25 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x2000, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$SOCK_DIAG_BY_FAMILY(r7, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x408000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x164, 0x14, 0x400, 0x70bd2a, 0x25dfdbfd, {0x28, 0x7}, [@INET_DIAG_REQ_BYTECODE={0xa0, 0x1, "7a506651b77a8165376defa4d9ed5df33ee6cb0d3969f99a55d1f36e1231663c0ad1ddaf68177ce51ae553fb311ab605c1f06da0573c1569c3c892a5aa3f489cb6db592c271fe5a612751a3f83e31da9e569840de217a5d301c2d983874f6ebac049c74dd5bf32654389546b91b13e71bcdeae2dd7ca5e49c949f51c58ea9f827736fdb1fca3d3969c52d63a9c1f390cb542c88720fd4f17c5358f91"}, @INET_DIAG_REQ_BYTECODE={0xae, 0x1, "f63816dfc37a0d83767f5a3bcdca260a44a50b16118da02add01ef9e6f57af4943869406fb70572b1fdf35675fa3d6a1dcc72681f951accebc49c23c7359bb22cb2b8ada4a807e403ab52b39252c66bb4af0eb13213f148ced2da5559b28e22c8fc3345925ba0dda38d5c8c6823ec803de0f0709de889200c8ad35c4ec50a1f1f86e933d787a211c00a0367268c6f23a29f84780b02f1e1a2d5bfddf56a0520110a6be49fa87fb5e01f0"}]}, 0x164}, 0x1, 0x0, 0x0, 0xc004}, 0x8800) setresgid(r6, 0x0, 0x0) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000000)={0xa0, 0x0, 0x5, {{0x6, 0x2, 0xffffffff00000000, 0x5, 0x35, 0xa2, {0x5, 0x0, 0x189, 0x3f, 0x7, 0x9, 0x1f, 0x8, 0x7, 0x20, 0x40, r4, r6, 0xffff, 0x9}}, {0x0, 0x18}}}, 0xa0) ioctl$SIOCX25GCAUSEDIAG(r1, 0x89e6, &(0x7f0000000100)={0x1, 0xbd}) [ 2489.239956] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2489.251951] ubi0: background thread "ubi_bgt0d" started, PID 17355 [ 2489.252010] ubi0: detaching mtd0 [ 2489.271970] ubi0: mtd0 is detached [ 2489.279662] ubi0: attaching mtd0 [ 2489.285709] ubi0: scanning is finished 21:56:25 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) 21:56:25 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x2605, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, 0xa0) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000180)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, 0x9, 0x3fb, 0x2, [@default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null]}) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) accept4$unix(r2, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e, 0x81800) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x0, 0xa5, &(0x7f00000000c0)=""/165}, &(0x7f0000001380)="59a580881e0b", 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x1, {0x0, 0x0, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200100000000, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$IMGETVERSION(r4, 0x80044942, &(0x7f00000003c0)) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x8, {0x0, 0x0, 0x2}}}, 0xa0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000200)={0x8b, 0x0, 0x0, 0x7fffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000380)='/dev/video2\x00', 0x2, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f0000000280)={r7, 0x80000001}) 21:56:25 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}}, 0xa0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0xc, @loopback, 0x4e22, 0x0, 'sed\x00', 0xa, 0x80000001, 0x37}, {@multicast1, 0x4e24, 0x3, 0x20, 0x5082, 0x400}}, 0x44) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) close(r1) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000280)={r6, 0xd0, "b22387963958d90d6be596664caba7bb941410db838c1f7e0205f41ef53d2fc8d3036643138d126f781cb9eb6cd96694ec5a08e6bf44a819bac842e54044a46548a9e043c16aed57e2f161faf988d57a4a506ce7f3493bd2b6aa422552d77df32f38104885d3ec014fcd63b63111fc6e563c68e8a70a75abf2786802beb1facfdcbd9e0ed36d91717b0bd7dffd8a1865e198f4e9780f9cf6d049eb0076cf76633363a818a4e14bdbaad6e93c88dddb2c9215a6b23670fb0e5140916e937bb5fb16d2579964c17fe8ab51d2728085d395"}, &(0x7f0000000080)=0xd8) [ 2489.391527] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2489.399599] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2489.424783] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 21:56:25 executing program 1: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) lremovexattr(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)=@random={'security.', '^)eth0{:\'\\[/security\\C#ppp0@!selinux\x00'}) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x469}}, 0xa0) r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000200)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000006c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) shutdown(r2, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$sock(r3, &(0x7f00000007c0)={&(0x7f00000004c0)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000740)="ad3039c921a18a7c2826f996ee223030fc63189d2bb2057933b03cac76c525806de13fcd64130c5df8665673fe4decde181499b03a27b240b704196f848f6b0a161191c5ae6b226623cae3c56ed2c7000f7e16edfed0ff630d909ee4b9eb3ba9f9a7daaaa2e9c14b0410483d915c9df030f55531a8a3fdb22de8fd8acb2dc937", 0x80}], 0x1}, 0x51) [ 2489.436357] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2489.455959] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2489.481253] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 21:56:25 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = eventfd(0x400) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r7, &(0x7f00000000c0)={0xa0}, 0xa0) r8 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r9 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r9, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r10 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r10, &(0x7f00000000c0)={0xa0}, 0xa0) io_submit(r0, 0x8, &(0x7f0000001840)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x81, r1, &(0x7f0000000000)="7e3c46a0d11bda2f831bbfc9a1b90fa9d01671f8b5e55d2bf4f06b51ab2522cd52c0c19e5e99def69e17084c81c864632b304043cb866bce07797eb8051ac8671b4b64396fd96094af3c9eb341b2c2920837829133c1e98c9def2bf23046f74978f0d9b2558da16aab4f2b392782977a4daf683d213fb6e4620b09", 0x7b, 0x5, 0x0, 0x0, r2}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2, 0x2, r3, &(0x7f00000004c0)="41094da98ef5a4c86043af4a3996a2ce3116a54844500d03ac7d921521a400d7a1a52217c8a90dbd534345e1e2ad48e6c52c3154fbaca4b600e5474b66e92603514b9df229719f735cd207536336e30c8ac5e6da0606ef7dc175d6f4ed70bb5ef21f0f5b8ac1e79c7465cc524453c613fdfe628929b1ccd67c98e99a728f7e3b58e2fc2e38492bb44b0997a9251f8ead0ebd48d7c517b0d927ca2c0bf944b9e5c80131963e57b9f5c70d43a26cad8bd47fa317a6f6d2f0704ce8fd58ef1d069db98341fdd31e3daca0957ab3df06119e171ef30af2ce4547742d6cd5000f4e97da5d36a09c9f4a91b7be7f9ebfec49ea1b898719d06eddbe4c81b68ca232dbf56fd2d45f9a731392687b64c016acb6026be9e100f2419e269dfa345a5b40a322e6bc8ad9ace272402b49f4e0e769510ee3753d536e15db068e9e4cfee57af9b3e37245d6bf4ed1818fe5334b891933d9d3b88653c442784756886a647fafbdabaeb7f57fb3a1077b80669cb53482b0b89fd3a8c6ac8b90d30f226f88099dbe557916bd96613d709423ebe72f5d5acdd5f1cb019680fa6e1fbe07c404e2d4144a6c478ed549d3b61eb43c59f9751cd698242298d62f26f8dd9a65c067ab8471df1486efe4180eb50e555d2d821f415845930c5ae622ca872d3b97aaa46732044e68da7f9fbd7cd92ed70cf82115a874cfae62318f49d7b29a9f9146fae633cd98f250a2bab2b0288bd87df04158e8effe1bdb16e71df9820ef8652688e17d1aa96f8a8a7f855cbd5a90479dd8a0f7cd0d694374b7457118378d3a91415c1467d92a6250293f186eca97d4eb0cb6d42d1e50d7138ea128d72608cc01f257e9fe74e220611549690ad98a05d3a3fb227eefc154ff3acfc1a5b4f8137bbe5a3459525ec1ea7070b949e4165404523652838382aa6ab94206f470796a364e18845e1e208fbd2b07206dcaf1c65a283ac6e09f0f522295db385178948b30476a317bc8b7347d229717c36c4367b705bb71976fde76101995e5e531a63ff89f119d7cb028903a932f4d7fd336d240d0c4f5e0120bb0b144b76d5601f80417f265cf8d3cd1dff86fe702cc79a8e234b3a771084d3b0af7988ca3217573d5d5e05f5f86a9825dd8e9065ba523a37219068ff31c31c863957c4ecba33188fc1d9de7ee8fa86ba0e311569002d0f50dd8502ea6fe8262b17b21981dd7bb4c4e618d3f91ca9df02437ae01b4ba3fa16d8d179e0eeb695ec4205457e790a8d3bf5f2ee49e4464ab4c2dab1d4101d0fdecf36328ac433cc89b1459864bc0d8836252e9cc300566f6c7802a0814878456acb6c0674b5d31d7a7e2826d7f67c3535b2bd9d7f7718f5605d2d636e3b3d1de314164c91aea1a9b60fa2aae28ead28fb3f0c1a279c610869c0c72570579091c8e6e56fadf736d7b2a26ba8e9e6c3edafbd623a4d8404c599a85fa186d8c0b3d52fd8d0e3b67b25f69b52896dfdf67df684adf3719511cd42bef0fa741b177d3a058f421b7a419b5dc43fbb48e88e1bb4e1780389342850c480352f928f97b3e811d33465cbe3d0a9c2f2ce8092ba2623c07bf84fc3ef1d3056c2ed1c0a8b0383c90ba762f90e578060c54a784c2b3a5c8f56f95b8b75bf4e844a5b0144220f070970025b2acada72003731c35798f0a8f2e50788f856e9f18c55472f41558ac6e6f08befa4e563e09562152df3a9051589e0ea965c0405139bc2ceb7859f2c926ff26fb55e633e3553fa297dc97ace55aef9b99226d48dc86d16ae3f80d01269405261326fd48baf0554f784c76f27353dc87da58fd93fd39552edbfc685e04342310ea85774f9f7b2f613369e621976e9967be8a031fe7dd8c4d3f594c23ce976d0650ce893093e44485f48d7358b6cc406a929e68ccaaef6f73483361bfb4fc1edb7618a64d35be8cbac05029f27f55738302d399901c030b172fb583d38597efaf318d497afcca9ef8d1f3361c850d1def19fcd8124351f012af4da86626bfcf8463b2ea80be896592705446cb1c0d0e7feeb55a174e8a325a041f056f9ce3e05df67712e8201b395d7149b061a60efcaf9a88973e7a75b757d60d1fdcfdde703d1c95cf1e05718d13147b202cb12954e4c540ba927f11015ce499ac9599d8bd1748dd5f35e3f0e057b5a4d09164797dd157198cf4103b1b5d6300d0cd9f2a1344d3388ad43adfbcc2ae42c0bcba2f0efb085c14cd5571516644e73bc452d8d36282a8a49f7fe2073b752a2bdcd6bf59108017df0fcca0579b8b6d968fe625223b49050ce4f6d1aafd11b5713bba8a20c3b4b664ffe7bbb8a5284d5b67447ce282be6a86f9f9d22ca1f60e1c623bd07627c983aa1ea5ecda463a836a0abdde023fa7be168dee864ca4a1382e64b43e3f0817a537f7c8c2dc5ebb6acf844c3a4054dbadf264b47eb61b632fc167aba4a3645a3568e6ee8c490b1e1afae89e36c873de2a6e0f4587ca5edc98c1c5a4f34e05f6d4f0c40749173e28569c119d492a7a9671ee61b283851e925d28b724c82935a7cd4bfe4da945524ccbfc7dffd4823ccca56fcbfd665d6e3d9d9121253e38bca99478db0ef70ca73a073589e2b9550a50ee8ff8239413e942dc94201e41746d85f0f18026504dea34832c5270dbe66c367e609a0022efcfe701600ae3c2adfc944799091d4cff85fa7a137570de9b0a482c06037b171cec0e0e6ef2d6dee4a10cc28a6ed6861f6bfb4332ebf9a9d6c7f652b33d02e971ced3addb21d6fe4995dd108ac17d5efa94d802f7e260d31ab521bef36cb5547c9dafe45c4edac0bd4328753d0f68c095e5d0e60246fe9b53d4f1a4af65b18c851bff553780f6bc26e16fb63db260369a79ac85ffe8847477b1b8e154af4e6ddb88926f22b91eacc8182ff0893cece4dd893d97ccc49b042520acb9b56c1a8706b79cfc2da28bfc831cc563e4ea40b5bd337c5d798e00957b555279b27d4d9b0b20235b34e6b3379e1a4a0b800f0924f1f782ef712df9dc59bd4ae525d47106a7038f041490cbeead3d86c37270d51b8052d0b8cf0034f70681341e1cd4e9d90faec8ba36cda57fd9a3665cf95b75cd7d61d349d2c0cbaa40674ab1620950ddc29596261f08aa52ba57dfd5617fdd5985fc3c6a3dc147f839939aeaf48192275c0c49493eb26d8196ce6c86beda286efaa4ea0a4ca1cbbd437caeaf6e37e194618cf4ec483e1675c31c579cc255518bd3bf9e695ff45ef8fcce9f86442b38acdb3bb1dae9b426c37c8f57efd81c712bcc96f262f46ef35f01a4c622553ebba30041b8ffff78683e687f56159fa4f8639324d296e5ccd9546f624734722a710b149acc3e221e814e9b7229423ebac665da3477c06cd22fddb1348c386c33938e428454aaa795f52212008a96e4737eb758f4ce8b8214654d2a79e2f68e70d6328abdf061d9f43e6db4b015adfa2accf58149b5fd441987fa892a92f6551cf088b7bf3d676af1024017c6573b32885a9dc8f618c2798fe390bff0d53f7061a2cd296dfd9d742084f4f4cdda34f312ce92ad56865dbfae90098cdffa728a3af1445a08b258fd237fb05f503f391e44be01005dcf27d842e8ed3db96f0ad9c53fc25aa76d7a8b36f2a88ddadf2a48c18a3341b33da9bd4a8740799d4d4a5c8d71edc87b7b4fb0ce2eb1a32a190431befe5089d027bb45fe13bc125a24057a50307e7f92790916db890035df1884e6d3600c84c01fcb26a692f90053537df28c27a2ed6da399798b7ef8f6e124167558187018801c216f42991b43bfba4002fefa846ef5f0fc2e0e10e86af0dcc7e0cf259465061b6af0d989bac2062ac82b47c6d716a5a5eae4f7512514d43513065f41e28039afae9563cd5bfd61ab7c10a48e02a057fb2c53447e91ce46b447af457d2220f925cd9da9178a7529ecf608ddecdd417610bd2a652e6aadf33cf4ceff076fa62e528518c9cdc017a901a1426e2280969784ee2f8295a2441c8fd08ab71ec4be9711aa3bd22e2c3b28c4d3acdae8e63f8bfd7b5b2bcc1e0ee6230b2584fb6b92b386c8f17b8c722e52da883b135260dd7dbd70fa5c74d6d86af7e65accdc043e1efcd9fe75d385cfd5665db01f803b47369b097f4c6a0e8857422b9963b8f339e0cf98086deb809cbd037a5430fc18b2d07f1b99d881029b99d45ae4fa628ea9408bd6c908627f4bb1244ff152da3a2e31443d887228252ceb486882f2aca00c8d6612bc14d50259a10da24699ee8366d5e456438a86e05b88f88ff08e5be7f66fe37d40b892a80ab13c42b7857807e0105afec1dc16cb3b8bd6e620d4d26e27f77454d6b15fb79540e99111be88be2ee395bc761a0ae4866fe534299d0cea76af59fd7e131354931a5cff322d854831bc3486cbc0c623fa155cb8e67a6d963dc5e8bd2aeb3458fd0958ad4517c95574450b83eb712bebc26d8bf8cdf91453bdaca495b3e249b1904874d0ab9a8f36abab98870ff01e615fae00ae1e3a52c1ef85df5854068ce4acd6a29fb80a51816eb5307f66371e8eaab6c13538528185e8d98bc41aad94935dbf9f4fab1579e1212349a2b15209985f64350a22525e5ffb4efd6ae41b6b28787f693af5aa949a0db027df9e3a0ccce47eb782fb5e0a060382f65399dda6ca9f16c8fa8eeb13cadce76c118c51a1fc99e7781c11dd19de0efb7a4bd84b96d9d16553012ee6ace914cce1584c27d7748cca53f0f052a108f8de912b204476074632ecf5d9b89fad4171dcac42fca4e19b47610b45b04fa5415789d22fe34b3c4de70c6595d258af0c4d8313225856e24b39fd27ac4d866f83c6ca244db8314394c40ece66ef7aabea419bd41848858ece1f18ff88ca5e4dcebd56d4593e1d598a2482ad890621914ded013b8420259bcacfe2c723b476e334f57d21fbf2a94ce1843efd498bb25f02a54a86218e836dfe54a5fa1c871ab7001dfc471885d8d86ec5c1e529a28ea59596587cb74f2af47fbbaa029ead9dce7adc482f4c89bba989e8f80bb3f777bcd6839e8f2b1ae041637370adf5f079bc0b68bd351aeed1ecadbd36696fec174810523903bd0170c2c51acdd6f3db87b8767adf9d6d212a3015996d9a89ded607dddc34d5b6a724d28f3ec2dc84359f961d25ef1d64d5a5af92d78a1991bdb830b59c564bae46af86c723cd2d3968417fa680a25ac58210eb2235cb0ee6340cb5531983413f579db8b37af8386b73d9f05a443f1ae72c9d19a82a1f4b2c0d12900a024421942061176ee6dc6827f69c5e5735aa2b27b87823a5237d28deed09ea293f79689227dd6bba6c7c0bf65edf700ca73bfd686b4014b573255094abbec66299a50c3836e637866e73df207b647d2b75efac834433d6cb215a630def2e0c83aa5cae666b18655f4a1e315d357c5f966248b83cc0ae3e0002c31bc36ed29adf550a6e8823873050e3c859bccd4b12970dbd1e1e2829e9422e55c380887595689e597dd879ed0fafcc1c68f994e4da8ad330ceb35c71c4e8583950c797ff7c7e89377b6e06d13e970bf39bf6ab9cc62b30e72e96442081eb1a25fc13e551554c87d9ee819cf69db57525bc61873d0493e545a486b55fe3ea9f6fd1f00b201b6236f181178c0d38600a3664fc7cb254e794d47404e05dafff7b4c713b80a6a9acda49cd847d9ac35ca34a2975655d8db1f364c621c46b722fc93ae3fa7109cab1a77c5346eefa0f33ce72ae1bf3f88c83b96dff4a568f715b091bfce6410db16a2cb173cca8e0fea6ade97e1783d3620100cc58a10fb8f9e99e4767bd10947f05e1e86947c02eac93a5fddfa3dd", 0x1000, 0xc9e, 0x0, 0x3, r2}, &(0x7f0000001800)={0x0, 0x0, 0x0, 0x1, 0x100, r4, &(0x7f0000000380)="5d28635be8949dd43758062e4040530ae43bbf516a3ff27ffcce7563880ef3ac196533a4300707e59bb9f018d89b9ec8d02b254610accd0c362310af9a378f1ae1c8bbfb4bab87ee22ac7bf40690a23d4052535656bd3ca00fea23c722b4ac68f03edf83bab46624d2cca885d97cff4c2a4f340e4f9568bcf828b1315e821ab1a73435a31ebf7c1eec2701a656d461640ef0c26380e307a23a531a9fbb2d83038fc7da021fac6efe58387143f382a064e71558d82c44cb852123d5", 0xbb, 0xff1, 0x0, 0x2, r5}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0xe, 0x6, r6, &(0x7f00000014c0)="77e9b4382ec914f3f38c522e2966618f03f31f9b20ffd6279fe953b1adb39cea08a7caeaee881d493ae115f2dcd85f40d31c0952eedcf594db7d7b39cbe05c98129d935d6fdf9deabf4c30d98ecb3509dadcdf8bb816de1771fdf25510", 0x5d, 0x0, 0x0, 0x3, r7}, &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, 0x7, r8, &(0x7f0000001540), 0x0, 0xff, 0x0, 0x1}, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x1, 0x101, r4, &(0x7f00000015c0)="2d04a210f457c34d8e7b7552ba6ffed824c12f9a8fdb19a4f3fdc2aa44ed0f67699690", 0x23, 0x1, 0x0, 0x1, r2}, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x5, 0x1f, r9, &(0x7f0000001640)="7868f30960097329923311c756d513d515532a739bf55081346dab56b4a29c86a7de1a4652941a5ae49966a540aeb0b3ba99a066a24ba6b878f2afefcb2b7ed02712413a8bdaa49d92ea882ded4b9e609a9fe92424f2009182d1603dbd3a5eaf93d14a", 0x63, 0x9, 0x0, 0x1, r10}, &(0x7f0000001540)={0x0, 0x0, 0x0, 0x1, 0x3f, r1, &(0x7f0000001700)="8e00a140822649ef1a235041197f6f7cc534053a978286f1d1741137663932ba9ccfb92322b119c58a72864776114216967d6d482939eb8cfa632c0b86abd848d307a9d2935bd0b170c55cbc97de9704fd066e7dfc0968bc859d0055af63f67fa1dd58ace07ebcc28794e98e25801927ef53fa5b6af57b7e1f05f441e18748cbf2d572f4bc4cf888ebacab742e6cef263446fac879f58b5eca6889a0d14a380841a3f6c2cfb9da8d023d16af5ebd154671d900102fa45cbeb3e0c14f4e0427347d00a2b86515396dafee9f560ee8a1eee60c64a7aa45fb56b350c0800c561bc798dac03a2a2577", 0xe7, 0x101, 0x0, 0x4, r2}]) [ 2489.509015] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2489.539634] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2489.551767] ubi0: background thread "ubi_bgt0d" started, PID 17380 [ 2489.565374] ubi0: detaching mtd0 [ 2489.574660] ubi0: mtd0 is detached [ 2489.579254] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2489.588164] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2489.594271] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2489.603306] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2489.605823] ubi0: attaching mtd0 [ 2489.612182] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2489.631563] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2489.640389] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2489.646388] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2489.655303] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 21:56:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:25 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) fsetxattr$security_selinux(r1, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:ssh_keysign_exec_t:s0\x00', 0x28, 0x1) close(r0) fcntl$getown(r0, 0x9) 21:56:25 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) [ 2489.664251] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2489.666640] ubi0: scanning is finished [ 2489.673545] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2489.682914] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2489.689192] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2489.698105] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2489.707014] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2489.780603] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2489.789655] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2489.795641] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2489.804586] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2489.813493] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2489.821762] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2489.835937] audit: type=1400 audit(1588542986.108:1203): avc: denied { associate } for pid=17405 comm="syz-executor.0" name="sg0" dev="devtmpfs" ino=17231 scontext=system_u:object_r:ssh_keysign_exec_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 21:56:26 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285629, &(0x7f0000000040)={0x0, 0x4, 0x9b, [], &(0x7f0000000000)=0x3}) close(r0) [ 2489.946128] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2489.948098] sd 0:0:1:0: [sg0] tag#2950 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2489.955141] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2489.963831] sd 0:0:1:0: [sg0] tag#2950 CDB: Read Block Limits [ 2489.969715] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2489.975607] sd 0:0:1:0: [sg0] tag#2950 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2489.984450] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2489.993398] sd 0:0:1:0: [sg0] tag#2950 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2490.002220] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2490.011075] sd 0:0:1:0: [sg0] tag#2950 CDB[20]: 9c 09 3f f0 09 [ 2490.037763] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK 21:56:26 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f00000000c0)) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x157cd) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @scatter={0x0, 0x200000, 0x0}, &(0x7f0000001380)="59a59588c65b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffe}) [ 2490.046633] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2490.052551] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2490.061503] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2490.065792] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2490.070571] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2490.090015] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2490.100631] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2490.119165] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2490.139177] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:26 executing program 1: syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000100)={0x2b, {{0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, [], 0x44}, 0xfffffffa}}}, 0x88) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x0, {0x0, 0x0, 0x1}}}, 0xa0) ioctl$IMHOLD_L1(r1, 0x80044948, &(0x7f0000000040)=0xa8ca) [ 2490.160745] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2490.181862] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 21:56:26 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x3e5240, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x3) close(r0) [ 2490.212742] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2490.228182] ubi0: background thread "ubi_bgt0d" started, PID 17422 [ 2490.234801] ubi0: detaching mtd0 [ 2490.251897] ubi0: mtd0 is detached 21:56:26 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) 21:56:26 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 21:56:26 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x4) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x608401, 0x0) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000080)="76f0212354d684d7f8666ba65179879846f4447cdef6e2d6f5fb6ce15d57f13711f900c3", 0x24, 0x6, 0x0, 0x0, r2}]) [ 2490.265428] ubi0: attaching mtd0 [ 2490.270349] ubi0: scanning is finished 21:56:26 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x48800, 0x0) close(r0) 21:56:26 executing program 0: close(0xffffffffffffffff) r0 = creat(&(0x7f0000000240)='./bus\x00', 0x12) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) syz_mount_image$ocfs2(&(0x7f0000000040)='ocfs2\x00', &(0x7f0000000080)='./bus\x00', 0x0, 0x5, &(0x7f00000003c0)=[{&(0x7f0000000180)="1ea0aa1700f3d7421ba38c9f445447f99b4f76fb01af5c", 0x17, 0x85}, {&(0x7f00000001c0)="ad68ba2587eb3fb25038f86473e6d65318cc6859afe3eb5a29c283dd71aa73a627b04f87c786ad8ffde7da11e208a3484607b9088c2678a799d4136165f9a4da67fc4a4de05d", 0x46, 0xee200000}, {&(0x7f0000000280)="bfb9211e91b5cc47c457565273aa", 0xe, 0x10001}, {&(0x7f00000002c0)="e4d2173535db5099b7191536b67c3e6c05f8e484f3d4a724163bb52feb90940b773d15693fcd44145a681bbf05682736a4f92bd9dbd76aa7b7952e4224db7737e0877b13d26d2142cf5b01ca9d16da4d76ae0845c7e35b752fd582b6b229627de66d99ffce5884847dfb745ddd473924e4e969cf68eb878ba0215656578bf5dcdda238c9906a5469ffebad8f1ea6697ffe3aacf7381d97fd884d1dff92f0a9c61ca78a0c1eab06329f239101bd577526e4b06deec8b4", 0xb6, 0x1f}, {&(0x7f0000000380)="0f12c224a2257c04b2ef0fbe3563", 0xe, 0x10001}], 0x3040802, &(0x7f0000000440)='-+vmnet1keyring!:\x00') bind$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={[], 0x11}}, 0x8) [ 2490.384580] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2490.391835] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2490.400073] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2490.409667] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2490.418600] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2490.426030] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2490.442795] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2490.452512] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2490.463868] ubi0: background thread "ubi_bgt0d" started, PID 17451 [ 2490.470520] ubi0: detaching mtd0 [ 2490.477502] ubi0: mtd0 is detached [ 2490.481140] ubi0: attaching mtd0 [ 2490.489179] ubi0: scanning is finished 21:56:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:26 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 21:56:26 executing program 5: r0 = socket(0x2c, 0x800, 0xfffffffa) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000000)=0x1, 0x4) io_setup(0x1, &(0x7f0000000300)=0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r1, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f0000000040), 0xff66}]) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x4280, 0x0) ioctl$RNDGETENTCNT(r3, 0x80045200, &(0x7f0000000080)) 21:56:26 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) dup(r0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/keycreate\x00', 0x2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r3 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mISDNtimer\x00', 0x8080, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r5, &(0x7f00000000c0)={0xa0}, 0xa0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r6, &(0x7f00000000c0)={0xa0}, 0xa0) creat(&(0x7f0000000240)='./bus\x00', 0x0) close(0xffffffffffffffff) [ 2490.631013] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2490.641337] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2490.654337] sd 0:0:1:0: [sg0] tag#2950 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2490.663282] sd 0:0:1:0: [sg0] tag#2950 CDB: Read Block Limits [ 2490.669231] sd 0:0:1:0: [sg0] tag#2950 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2490.678203] sd 0:0:1:0: [sg0] tag#2950 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2490.687178] sd 0:0:1:0: [sg0] tag#2950 CDB[20]: 9c 09 3f f0 09 [ 2490.702932] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2490.709220] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2490.712096] sd 0:0:1:0: [sg0] tag#2987 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2490.723594] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2490.724826] sd 0:0:1:0: [sg0] tag#2987 CDB: Read Block Limits [ 2490.736118] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2490.736668] sd 0:0:1:0: [sg0] tag#2987 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2490.751980] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2490.752747] sd 0:0:1:0: [sg0] tag#2987 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2490.770955] sd 0:0:1:0: [sg0] tag#2987 CDB[20]: 9c 09 3f f0 09 [ 2490.770960] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2490.771006] ubi: mtd0 is already attached to ubi0 [ 2490.777274] ubi0: background thread "ubi_bgt0d" started, PID 17476 [ 2490.800620] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2490.816300] sd 0:0:1:0: [sg0] tag#2950 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2490.825419] sd 0:0:1:0: [sg0] tag#2950 CDB: Read Block Limits [ 2490.827899] ubi0: detaching mtd0 [ 2490.831349] sd 0:0:1:0: [sg0] tag#2950 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2490.831391] sd 0:0:1:0: [sg0] tag#2950 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2490.831422] sd 0:0:1:0: [sg0] tag#2950 CDB[20]: 9c 09 3f f0 09 [ 2490.845772] ubi0: mtd0 is detached [ 2490.881036] ubi0: attaching mtd0 21:56:27 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) 21:56:27 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2490.906832] ubi0: scanning is finished 21:56:27 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$VT_DISALLOCATE(r0, 0x5608) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f0000000400)={0x1, 0x0, 0x4, 0xf, 0x1e8}) 21:56:27 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x410900, 0x0) close(r0) [ 2491.015004] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2491.021797] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2491.029413] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2491.035759] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2491.043586] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2491.049657] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 21:56:27 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) getsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080), &(0x7f00000000c0)=0x4) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000040)=@md5={0x1, "e0a7923636085dd2f48c699822ffe140"}, 0x11, 0x2) close(r0) 21:56:27 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x0, 0x100000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, 0xa0) getsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000080)={0x7, 0x1, 0xad, 0x6, 0x7}, 0xc) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2491.058776] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2491.068783] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2491.085199] ubi0: detaching mtd0 [ 2491.097844] ubi0: mtd0 is detached [ 2491.103934] ubi0: attaching mtd0 [ 2491.108886] ubi0: scanning is finished 21:56:27 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) socket$netlink(0x10, 0x3, 0x0) 21:56:27 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) close(r0) [ 2491.256505] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2491.264005] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2491.270677] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2491.277562] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2491.284990] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2491.291205] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2491.301866] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2491.316815] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2491.326556] ubi0: background thread "ubi_bgt0d" started, PID 17535 [ 2491.327479] ubi: mtd0 is already attached to ubi0 [ 2491.340551] ubi0: detaching mtd0 [ 2491.346960] ubi0: mtd0 is detached [ 2491.350873] ubi0: attaching mtd0 [ 2491.358862] ubi0: scanning is finished [ 2491.449977] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2491.457019] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2491.465919] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2491.472241] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2491.479745] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2491.486290] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 21:56:27 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) setuid(0x0) 21:56:27 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x20000, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x3c, 0x20, 0x200, 0x70bd26, 0x25dfdbfe, {0x2, 0x14, 0x10, 0x3, 0x8, 0x0, 0x0, 0x8, 0x2}, [@FRA_FLOW={0x8, 0xb, 0x2}, @FRA_SRC={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0xa}}, @FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e23, 0x4e22}}, @FRA_DST={0x8, 0x1, @remote}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044}, 0x4080) 21:56:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:27 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 21:56:27 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_ADD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8020100}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000080007000ab6e9d05b7b2031264de46cb7a67dde01010108000700ac1414bb0508bb00000000000000000000000000282a1964be16811af5fd8f3ae338fa312cff7c4d683c2a10cc2f5af505ce1ee9f6ab19fb8ffc786c820cd61d4788f8ac83fd5ab76af1fc9959da4b5b9e8c96fbc641eea282a7da3f5e89b7ba3aafa298aa54832d7ad6ab9ac48a992615f1e347bf386c43b59e9f931a92dee62f3eaafa4ae1ae0155e5b8dd4496dfec535fee381189c10949954b1c61ab"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) [ 2491.494160] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2491.504045] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2491.513870] ubi0: background thread "ubi_bgt0d" started, PID 17549 [ 2491.520264] ubi0: detaching mtd0 [ 2491.531032] ubi0: mtd0 is detached 21:56:27 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) [ 2491.569067] ubi0: attaching mtd0 [ 2491.577127] ubi0: scanning is finished [ 2491.707105] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2491.716315] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2491.717421] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2491.744831] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 21:56:28 executing program 5: io_setup(0x5, &(0x7f0000000040)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}]) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) read$char_usb(r2, &(0x7f0000000640)=""/4096, 0x1000) [ 2491.753407] selinux_nlmsg_perm: 322 callbacks suppressed [ 2491.753416] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2491.761606] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2491.787525] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2491.794715] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2491.814662] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2491.828081] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2491.851959] ubi0: background thread "ubi_bgt0d" started, PID 17586 [ 2491.858645] ubi: mtd0 is already attached to ubi0 [ 2491.873219] ubi0: detaching mtd0 [ 2491.884875] ubi0: mtd0 is detached [ 2491.888574] ubi0: attaching mtd0 [ 2491.908255] ubi0: scanning is finished 21:56:28 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) setuid(0x0) [ 2491.963339] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 21:56:28 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 21:56:28 executing program 5: io_setup(0x1, &(0x7f0000000300)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x20000004003}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r1, &(0x7f0000000040)}]) [ 2492.077807] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.133022] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2492.149131] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2492.178610] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2492.181900] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.200294] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2492.213664] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:28 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000080)={0x5, &(0x7f00000001c0)=[{}, {}, {0x0}, {}, {}]}) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000200)=0x4) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000180)={r2}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000000)={r2, 0x2}) close(r0) [ 2492.240193] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2492.259142] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2492.276875] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.282578] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2492.310882] ubi0: background thread "ubi_bgt0d" started, PID 17615 [ 2492.321441] ubi0: detaching mtd0 [ 2492.331017] ubi0: mtd0 is detached 21:56:28 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) [ 2492.339316] ubi0: attaching mtd0 [ 2492.344968] ubi0: scanning is finished [ 2492.377137] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 21:56:28 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) 21:56:28 executing program 0: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r0, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000000)) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) [ 2492.488439] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.535402] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2492.554781] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2492.577478] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2492.588933] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.607832] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2492.627022] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2492.641342] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2492.665139] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2492.677734] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.687514] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2492.712768] ubi0: background thread "ubi_bgt0d" started, PID 17647 [ 2492.719324] ubi0: detaching mtd0 [ 2492.736174] ubi0: mtd0 is detached [ 2492.750864] ubi0: attaching mtd0 [ 2492.760051] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17587 comm=syz-executor.3 [ 2492.764209] ubi0: scanning is finished 21:56:29 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000000)={0x101, 0x0, 0x0, 'queue1\x00', 0x5}) close(r0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00000001c0)={r6}, 0x8) 21:56:29 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) setuid(0x0) 21:56:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2492.890912] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2492.904971] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2492.933594] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2492.952215] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2492.969450] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2492.984900] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2493.001674] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2493.022723] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:29 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 21:56:29 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x506c83, 0x0) close(r0) [ 2493.045329] ubi0: detaching mtd0 [ 2493.057520] ubi0: mtd0 is detached [ 2493.059499] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2493.070165] ubi0: attaching mtd0 [ 2493.078482] ubi0: scanning is finished 21:56:29 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x224d00, 0x0) close(r0) [ 2493.246182] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 21:56:29 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x301, 0xa0000) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) kcmp(r2, r3, 0x0, r4, r1) close(r0) [ 2493.289929] ubi0: attaching mtd0 [ 2493.294923] ubi0: scanning is finished 21:56:29 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x400100, 0x0) close(r0) 21:56:29 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) 21:56:29 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) [ 2493.414414] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 2493.440025] ubi0: attaching mtd0 [ 2493.444841] ubi0: scanning is finished 21:56:29 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x1) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/21) [ 2493.534588] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2493.541640] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2493.551106] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2493.567319] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2493.577484] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2493.590777] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2493.604933] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2493.627664] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2493.642377] ubi0: background thread "ubi_bgt0d" started, PID 17695 [ 2493.650254] ubi0: detaching mtd0 [ 2493.660783] ubi0: mtd0 is detached [ 2493.676801] ubi0: attaching mtd0 [ 2493.688725] ubi0: scanning is finished 21:56:30 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) 21:56:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a000100"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2493.799524] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2493.807653] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2493.823672] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2493.830107] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2493.838242] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2493.845253] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2493.853894] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2493.863912] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2493.874916] ubi0: background thread "ubi_bgt0d" started, PID 17714 [ 2493.881760] ubi0: detaching mtd0 [ 2493.892151] ubi0: mtd0 is detached 21:56:30 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) [ 2493.899340] ubi0: attaching mtd0 [ 2493.911752] ubi0: scanning is finished [ 2493.946463] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2493.985537] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2493.993223] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2493.999968] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2494.007013] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2494.020242] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2494.032332] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2494.045955] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2494.058353] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2494.068219] ubi0: background thread "ubi_bgt0d" started, PID 17727 [ 2494.075197] ubi: mtd0 is already attached to ubi0 [ 2494.080959] ubi0: detaching mtd0 21:56:30 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) [ 2494.099912] ubi0: mtd0 is detached [ 2494.108216] ubi0: attaching mtd0 [ 2494.119489] ubi0: scanning is finished 21:56:30 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) [ 2494.291416] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2494.303861] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2494.321386] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2494.330271] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2494.339137] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2494.347133] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2494.360257] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2494.377626] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:30 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) setuid(0x0) [ 2494.390356] ubi0: background thread "ubi_bgt0d" started, PID 17747 [ 2494.402501] ubi0: detaching mtd0 [ 2494.418605] ubi0: mtd0 is detached [ 2494.425448] ubi0: attaching mtd0 [ 2494.430067] ubi0: scanning is finished [ 2494.540796] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2494.556234] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2494.579787] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2494.590622] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2494.600543] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2494.610772] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2494.621106] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2494.636571] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2494.646956] ubi0: background thread "ubi_bgt0d" started, PID 17756 [ 2494.659945] ubi0: detaching mtd0 [ 2494.667420] ubi0: mtd0 is detached [ 2494.684254] ubi0: attaching mtd0 21:56:31 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a000100"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:31 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2494.689135] ubi0: scanning is finished [ 2494.819518] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2494.827941] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2494.844969] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2494.853379] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2494.870214] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2494.884932] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2494.896969] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2494.910216] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2494.931771] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2494.951291] ubi0: background thread "ubi_bgt0d" started, PID 17766 [ 2494.951305] ubi: mtd0 is already attached to ubi0 [ 2494.969333] ubi0: detaching mtd0 [ 2494.985183] ubi0: mtd0 is detached [ 2494.998001] ubi0: attaching mtd0 [ 2495.003364] ubi0: scanning is finished 21:56:31 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) 21:56:31 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) [ 2495.167247] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2495.178548] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2495.193280] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2495.208414] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2495.227178] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2495.254902] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2495.286038] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2495.318336] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:31 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) setuid(0x0) [ 2495.342926] ubi0: background thread "ubi_bgt0d" started, PID 17781 [ 2495.342989] ubi0: detaching mtd0 [ 2495.366075] ubi0: mtd0 is detached [ 2495.375579] ubi0: attaching mtd0 [ 2495.379981] ubi0: scanning is finished [ 2495.484256] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2495.502242] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2495.525749] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2495.539883] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2495.557037] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2495.570074] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2495.586763] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2495.597537] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2495.608631] ubi0: background thread "ubi_bgt0d" started, PID 17791 [ 2495.615688] ubi0: detaching mtd0 21:56:31 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2495.623857] ubi0: mtd0 is detached [ 2495.631137] ubi0: attaching mtd0 [ 2495.636374] ubi0: scanning is finished 21:56:31 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a000100"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2495.751592] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2495.770367] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2495.772349] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2495.818340] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2495.828822] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2495.839050] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2495.866253] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2495.890667] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2495.919678] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:32 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) 21:56:32 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) [ 2495.938135] ubi0: background thread "ubi_bgt0d" started, PID 17804 [ 2495.946081] ubi: mtd0 is already attached to ubi0 [ 2495.951023] ubi0: detaching mtd0 [ 2495.959559] ubi0: mtd0 is detached [ 2495.972790] ubi0: attaching mtd0 [ 2495.977283] ubi0: scanning is finished [ 2496.087888] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2496.109093] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2496.137497] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2496.158440] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2496.183382] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2496.208948] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2496.232677] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2496.258309] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2496.284813] ubi0: detaching mtd0 [ 2496.285826] ubi0: background thread "ubi_bgt0d" started, PID 17816 [ 2496.298984] ubi0: mtd0 is detached 21:56:32 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) setuid(0x0) [ 2496.307986] ubi0: attaching mtd0 [ 2496.319206] ubi0: scanning is finished [ 2496.415664] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2496.432226] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2496.454331] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2496.461155] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2496.476058] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2496.483000] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2496.491999] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2496.503671] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e000000"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2496.513638] ubi0: detaching mtd0 [ 2496.513665] ubi0: background thread "ubi_bgt0d" started, PID 17831 [ 2496.550492] ubi0: mtd0 is detached [ 2496.559132] ubi0: attaching mtd0 21:56:32 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) [ 2496.569394] ubi0: scanning is finished [ 2496.641178] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2496.647166] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2496.665380] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2496.678428] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2496.687048] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2496.699212] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2496.707102] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2496.720565] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2496.733278] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2496.749643] ubi0: background thread "ubi_bgt0d" started, PID 17844 [ 2496.757574] ubi: mtd0 is already attached to ubi0 [ 2496.762742] ubi0: detaching mtd0 [ 2496.777188] ubi0: mtd0 is detached 21:56:33 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) [ 2496.789473] ubi0: attaching mtd0 [ 2496.806281] ubi0: scanning is finished 21:56:33 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) [ 2496.960182] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2496.967655] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2496.983787] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2496.990503] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2496.999936] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2497.007832] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2497.016447] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2497.026858] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2497.037139] ubi0: background thread "ubi_bgt0d" started, PID 17859 [ 2497.044623] ubi0: detaching mtd0 [ 2497.051194] ubi0: mtd0 is detached 21:56:33 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') setuid(0x0) [ 2497.066076] ubi0: attaching mtd0 [ 2497.072118] ubi0: scanning is finished [ 2497.188356] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2497.202049] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2497.211382] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2497.226340] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2497.236571] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2497.247399] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2497.258851] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2497.273376] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2497.289390] ubi0: background thread "ubi_bgt0d" started, PID 17868 [ 2497.298944] ubi0: detaching mtd0 [ 2497.308265] ubi0: mtd0 is detached [ 2497.332557] ubi0: attaching mtd0 [ 2497.337722] ubi0: scanning is finished 21:56:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e000000"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) 21:56:33 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) socket$netlink(0x10, 0x3, 0x0) [ 2497.499315] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2497.511521] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2497.525550] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2497.540397] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2497.558777] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2497.570751] selinux_nlmsg_perm: 400 callbacks suppressed [ 2497.570760] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2497.595644] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2497.610912] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2497.627851] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2497.648824] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2497.670837] ubi0: background thread "ubi_bgt0d" started, PID 17881 [ 2497.677476] ubi: mtd0 is already attached to ubi0 [ 2497.687249] ubi0: detaching mtd0 [ 2497.687494] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2497.695671] ubi0: mtd0 is detached 21:56:34 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) 21:56:34 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) [ 2497.722329] ubi0: attaching mtd0 [ 2497.731968] ubi0: scanning is finished [ 2497.785018] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2497.869812] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2497.913592] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2497.939928] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2497.942395] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2497.972038] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2497.993890] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2498.009588] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2498.022832] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2498.024816] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2498.039371] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2498.055280] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2498.064987] ubi0: background thread "ubi_bgt0d" started, PID 17896 21:56:34 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') setuid(0x0) [ 2498.065004] ubi0: detaching mtd0 [ 2498.083418] ubi0: mtd0 is detached [ 2498.087534] ubi0: attaching mtd0 [ 2498.091931] ubi0: scanning is finished [ 2498.152908] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2498.198603] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2498.229649] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2498.255208] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2498.257324] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2498.305400] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17878 comm=syz-executor.3 [ 2498.309720] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2498.346212] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2498.367259] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2498.385675] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 21:56:34 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e000000"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2498.405415] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2498.433254] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2498.459914] ubi0: background thread "ubi_bgt0d" started, PID 17907 [ 2498.472146] ubi0: detaching mtd0 [ 2498.478749] ubi0: mtd0 is detached [ 2498.489234] ubi0: attaching mtd0 [ 2498.493786] ubi0: scanning is finished 21:56:34 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) socket$netlink(0x10, 0x3, 0x0) [ 2498.578402] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2498.636565] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 2498.659405] ubi0: attaching mtd0 [ 2498.665112] ubi0: scanning is finished [ 2498.780238] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 2498.810252] ubi0: attaching mtd0 [ 2498.820304] ubi0: scanning is finished 21:56:35 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) 21:56:35 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) socket$inet_udplite(0x2, 0x2, 0x88) [ 2498.981944] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 21:56:35 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') setuid(0x0) [ 2499.026670] ubi0: attaching mtd0 [ 2499.031414] ubi0: scanning is finished [ 2499.109475] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2499.116924] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2499.124122] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2499.130681] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2499.138453] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2499.145636] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2499.154618] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2499.164570] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2499.174511] ubi0: background thread "ubi_bgt0d" started, PID 17946 [ 2499.181159] ubi0: detaching mtd0 [ 2499.191026] ubi0: mtd0 is detached [ 2499.198590] ubi0: attaching mtd0 [ 2499.203402] ubi0: scanning is finished 21:56:35 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) [ 2499.255002] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2499.262674] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2499.277295] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2499.287915] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2499.295968] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 21:56:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2499.303112] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2499.310502] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2499.321457] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2499.331358] ubi0: background thread "ubi_bgt0d" started, PID 17954 [ 2499.338421] ubi: mtd0 is already attached to ubi0 [ 2499.343995] ubi0: detaching mtd0 21:56:35 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) [ 2499.360324] ubi0: mtd0 is detached [ 2499.368662] ubi0: attaching mtd0 [ 2499.374628] ubi0: scanning is finished 21:56:35 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) [ 2499.467399] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2499.515298] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2499.527015] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2499.548096] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2499.557474] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2499.565663] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2499.572784] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2499.581732] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2499.592986] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2499.602839] ubi0: background thread "ubi_bgt0d" started, PID 17975 [ 2499.604849] ubi0: detaching mtd0 21:56:35 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) setuid(0x0) [ 2499.620525] ubi0: mtd0 is detached [ 2499.631167] ubi0: attaching mtd0 [ 2499.636693] ubi0: scanning is finished 21:56:36 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r2, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x5, 0x8000, 0x3, 0x9d, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)={r3}) [ 2499.742183] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2499.756391] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2499.778310] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2499.784837] ubi0: VID header offset: 64 (aligned 64), data offset: 128 21:56:36 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x1407, 0x200, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x90) close(r0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001340)={0x7, 0x0, [{0x4000, 0x1000, &(0x7f0000000280)=""/4096}, {0x14000, 0x16, &(0x7f0000000180)=""/22}, {0x100000, 0x1a, &(0x7f00000001c0)=""/26}, {0x2000, 0x33, &(0x7f0000000200)=""/51}, {0x0, 0x3f, &(0x7f0000001280)=""/63}, {0x100000, 0xb, &(0x7f00000012c0)=""/11}, {0x3004, 0x35, &(0x7f0000001300)=""/53}]}) [ 2499.791531] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2499.803664] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2499.810957] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2499.825577] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2499.835422] ubi0: detaching mtd0 21:56:36 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x30b100, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) socket$inet6(0xa, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0xf0) write(r2, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0/file0\x00', &(0x7f0000000340)='./file0\x00') socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8, 0x80010, 0xffffffffffffffff, 0x8d452000) open(&(0x7f0000000180)='./file0\x00', 0x44080, 0x39) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) truncate(&(0x7f0000000240)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') 21:56:36 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) [ 2499.835948] ubi0: background thread "ubi_bgt0d" started, PID 17985 [ 2499.849276] ubi0: mtd0 is detached [ 2499.863885] ubi0: attaching mtd0 [ 2499.873739] ubi0: scanning is finished [ 2499.931745] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2499.938749] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2499.946794] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2499.954022] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2499.960793] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2499.978213] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2499.986043] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2500.008983] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2500.034251] ubi0: background thread "ubi_bgt0d" started, PID 18002 [ 2500.034263] ubi: mtd0 is already attached to ubi0 [ 2500.057982] ubi0: detaching mtd0 [ 2500.076737] ubi0: mtd0 is detached [ 2500.081492] ubi0: attaching mtd0 21:56:36 executing program 4: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) [ 2500.093518] ubi0: scanning is finished 21:56:36 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000040)=0x60, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) 21:56:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe2, 0x0) [ 2500.223851] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2500.240822] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2500.259270] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2500.276495] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2500.296449] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2500.313559] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2500.333900] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2500.361064] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 21:56:36 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x121101, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e) ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e) setuid(0x0) [ 2500.385735] ubi0: background thread "ubi_bgt0d" started, PID 18018 [ 2500.392955] ubi0: detaching mtd0 [ 2500.398208] ubi0: mtd0 is detached [ 2500.401873] ubi0: attaching mtd0 [ 2500.408847] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2500.413102] ubi0: scanning is finished [ 2500.524744] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2500.535970] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2500.557314] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2500.564621] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2500.571748] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2500.583794] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2500.592751] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3626484052 [ 2500.602585] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2500.613190] ubi0: background thread "ubi_bgt0d" started, PID 18034 [ 2500.613207] ubi0: detaching mtd0 21:56:36 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x20400, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000080)={0x0, {0x2, 0x4e21, @private=0xa010101}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e24, @multicast1}, 0x20, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)='xfrm0\x00', 0x3ff, 0x0, 0xe8b}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) r2 = socket(0x25, 0x2, 0x1) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f0000001840)={{0x16, @private=0xa010102, 0x4e24, 0x2, 'wrr\x00', 0x26, 0x0, 0x2a}, {@multicast1, 0x4e23, 0x2, 0x4, 0x0, 0x8}}, 0x44) mq_open(&(0x7f00000001c0)='/sys/kernel/debug/binder/transaction_log\x00', 0x2, 0x100, &(0x7f0000000200)={0x7fffffff, 0x3ac, 0x7f, 0x81}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$NBD_CLEAR_SOCK(r4, 0xab04) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000100)={0x0, r3, 0x7fff, 0x5, 0x7ff, 0x528940c0}) close(r1) 21:56:36 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000}}, 0xffffffffffffff51) r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) ioctl$EXT4_IOC_GROUP_ADD(r2, 0x40286608, &(0x7f00000001c0)={0x81, 0x3ff, 0x3, 0x3f, 0x4, 0xfa}) r3 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r3, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000380)={0x7, 0x20, @value=0x1}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f00000004c0)=0x13) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400)='batadv\x00') sendmsg$BATADV_CMD_GET_GATEWAYS(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="110700000000000000000900000008000300", @ANYRES32=r5, @ANYBLOB="59acdc123f387bf2bb631686752b5f8c72638404640bd24306384683e7b04e70462246aba9b1f5c41b7081"], 0x1c}}, 0x0) r8 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x25, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000340)="054a3bb5e3382ba0f4bd92cebb4cd68334656099dff380034dfdb2341d1d38319c093ff009", &(0x7f0000000140)=""/94, 0x20, 0x0, 0xffffffffffffffff, &(0x7f00000001c0)}) splice(r8, &(0x7f00000002c0)=0x6, r0, &(0x7f0000000300), 0x7, 0x1) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="0004264417ab674cd43070a177286f250d00008d00003c0000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x44014}, 0x4000010) [ 2500.728729] scsi_io_completion: 7 callbacks suppressed [ 2500.728755] sd 0:0:1:0: [sg0] tag#3001 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2500.743224] sd 0:0:1:0: [sg0] tag#3001 CDB: Read Block Limits [ 2500.749128] sd 0:0:1:0: [sg0] tag#3001 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2500.758050] sd 0:0:1:0: [sg0] tag#3001 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2500.766977] sd 0:0:1:0: [sg0] tag#3001 CDB[20]: 9c 09 3f f0 09 [ 2500.787363] sd 0:0:1:0: [sg0] tag#3001 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2500.796395] sd 0:0:1:0: [sg0] tag#3001 CDB: Read Block Limits [ 2500.802929] sd 0:0:1:0: [sg0] tag#3001 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2500.811827] sd 0:0:1:0: [sg0] tag#3001 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2500.820745] sd 0:0:1:0: [sg0] tag#3001 CDB[20]: 9c 09 3f f0 09 [ 2500.831774] sd 0:0:1:0: [sg0] tag#3001 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 2500.840593] sd 0:0:1:0: [sg0] tag#3001 CDB: Read Block Limits [ 2500.846609] sd 0:0:1:0: [sg0] tag#3001 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2500.855546] sd 0:0:1:0: [sg0] tag#3001 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2500.864497] sd 0:0:1:0: [sg0] tag#3001 CDB[20]: 9c 09 3f f0 09 [ 2500.876302] sd 0:0:1:0: [sg0] tag#3001 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK 21:56:37 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, &(0x7f0000000000)=0x4, 0x4) close(r0) [ 2500.885415] sd 0:0:1:0: [sg0] tag#3001 CDB: Read Block Limits [ 2500.891415] sd 0:0:1:0: [sg0] tag#3001 CDB[00]: 05 4a 3b b5 e3 38 2b a0 f4 bd 92 ce bb 4c d6 83 [ 2500.900317] sd 0:0:1:0: [sg0] tag#3001 CDB[10]: 34 65 60 99 df f3 80 03 4d fd b2 34 1d 1d 38 31 [ 2500.909353] sd 0:0:1:0: [sg0] tag#3001 CDB[20]: 9c 09 3f f0 09 21:56:37 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x2, 0x3, 0x300, 0x0, 0x0, 0x190, 0x190, 0x190, 0x268, 0x268, 0x268, 0x268, 0x268, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0x130, 0x190, 0x0, {}, [@common=@unspec=@string={{0xc0, 'string\x00'}, {0xac00, 0x0, 'bm\x00', "bdc74c01369df17d17ac76fa5f9b3bfa0c34430d864040bc25b2b73a59aa6ecab6b1d2cc05e3182f64694d7d05fb8b8c8f56627a54f905d564eeeb8334f650ca0f3c44f7fda4d20a55050342ea85ecc8838e7088de33582f36a0a375bb7008adc297a5ece1bb2df53d17bef26bb6f800"}}]}, @common=@SET={0x60, 'SET\x00'}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'hsr0\x00', 'ip6gretap0\x00'}, 0x0, 0x98, 0xd8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x360) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) write$P9_RGETATTR(r1, &(0x7f0000000180)={0xa0, 0x19, 0x0, {0x0, {}, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x8, 0x0, 0x0, 0x1}}, 0xa0) getsockname$llc(r1, &(0x7f0000000000), &(0x7f0000000040)=0x10) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r2) 21:56:37 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x4, 0x402100) 21:56:37 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/dlm-monitor\x00', 0x4000, 0x0) close(r0) 21:56:37 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x140, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) close(r0) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/142) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0}, 0xa0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x1) [ 2585.837894] NOHZ: local_softirq_pending 08 [ 2721.503272] INFO: task syz-executor.1:18005 blocked for more than 140 seconds. [ 2721.510666] Not tainted 4.14.178-syzkaller #0 [ 2721.516327] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2721.524373] syz-executor.1 D29584 18005 6372 0x00000004 [ 2721.530005] Call Trace: [ 2721.532576] ? __schedule+0x7b8/0x1ca0 [ 2721.536522] ? __sched_text_start+0x8/0x8 [ 2721.540679] ? __sched_text_start+0x8/0x8 [ 2721.544893] schedule+0x8d/0x1b0 [ 2721.548316] schedule_timeout+0x946/0xe40 [ 2721.552554] ? usleep_range+0x130/0x130 [ 2721.556649] ? wait_for_completion+0x239/0x390 [ 2721.561233] ? mark_held_locks+0xa6/0xf0 [ 2721.565349] ? _raw_spin_unlock_irq+0x24/0x80 [ 2721.569837] wait_for_completion+0x241/0x390 [ 2721.574411] ? try_to_wake_up+0x9a/0xef0 [ 2721.578473] ? wait_for_completion_interruptible+0x3e0/0x3e0 [ 2721.584432] ? wake_up_q+0xe0/0xe0 [ 2721.587976] kthread_stop+0xce/0x640 [ 2721.591669] ubi_detach_mtd_dev+0x1e3/0x3cc [ 2721.596054] ctrl_cdev_ioctl+0x14b/0x220 [ 2721.600119] ? vol_cdev_llseek+0x140/0x140 [ 2721.604422] ? selinux_file_ioctl+0x3f7/0x560 [ 2721.608910] ? vol_cdev_llseek+0x140/0x140 [ 2721.613202] do_vfs_ioctl+0x75a/0xfe0 [ 2721.617011] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2721.621757] ? ioctl_preallocate+0x1a0/0x1a0 [ 2721.626232] ? security_file_ioctl+0x76/0xb0 [ 2721.630631] ? security_file_ioctl+0x83/0xb0 [ 2721.635098] SyS_ioctl+0x7f/0xb0 [ 2721.638465] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2721.642429] do_syscall_64+0x1d5/0x640 [ 2721.646369] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2721.651547] RIP: 0033:0x45c829 [ 2721.654798] RSP: 002b:00007f185c67dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2721.662497] RAX: ffffffffffffffda RBX: 00000000004e0d80 RCX: 000000000045c829 [ 2721.669820] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000004 [ 2721.677166] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2721.684600] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2721.691862] R13: 0000000000000209 R14: 00000000004c42c1 R15: 00007f185c67e6d4 [ 2721.699834] INFO: task syz-executor.4:18013 blocked for more than 140 seconds. [ 2721.707291] Not tainted 4.14.178-syzkaller #0 [ 2721.712303] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2721.720302] syz-executor.4 D29904 18013 6374 0x00000004 [ 2721.726237] Call Trace: [ 2721.728852] ? __schedule+0x7b8/0x1ca0 [ 2721.732787] ? __mutex_lock+0x737/0x1470 [ 2721.736849] ? __sched_text_start+0x8/0x8 [ 2721.740987] ? lock_downgrade+0x6e0/0x6e0 [ 2721.745275] schedule+0x8d/0x1b0 [ 2721.748637] schedule_preempt_disabled+0xf/0x20 [ 2721.753373] __mutex_lock+0x73c/0x1470 [ 2721.757261] ? lock_downgrade+0x6e0/0x6e0 [ 2721.761394] ? mutex_trylock+0x1a0/0x1a0 [ 2721.765516] ? ctrl_cdev_ioctl+0x190/0x220 [ 2721.769748] ? mutex_trylock+0x1a0/0x1a0 [ 2721.773869] ? __get_mtd_device+0x130/0x130 [ 2721.778195] ? __might_fault+0x177/0x1b0 [ 2721.782280] ? ctrl_cdev_ioctl+0x190/0x220 [ 2721.786584] ctrl_cdev_ioctl+0x190/0x220 [ 2721.790639] ? vol_cdev_llseek+0x140/0x140 [ 2721.794942] ? selinux_file_ioctl+0x3f7/0x560 [ 2721.799428] ? vol_cdev_llseek+0x140/0x140 [ 2721.803720] do_vfs_ioctl+0x75a/0xfe0 [ 2721.807553] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2721.812287] ? ioctl_preallocate+0x1a0/0x1a0 [ 2721.816757] ? security_file_ioctl+0x76/0xb0 [ 2721.821217] ? security_file_ioctl+0x83/0xb0 [ 2721.826192] SyS_ioctl+0x7f/0xb0 [ 2721.829558] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2721.833578] do_syscall_64+0x1d5/0x640 [ 2721.837470] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2721.842736] RIP: 0033:0x45c829 [ 2721.845914] RSP: 002b:00007f3eb437fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2721.853665] RAX: ffffffffffffffda RBX: 00000000004e0d80 RCX: 000000000045c829 [ 2721.860933] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000003 [ 2721.868269] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2721.875597] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2721.882922] R13: 0000000000000209 R14: 00000000004c42c1 R15: 00007f3eb43806d4 [ 2721.890215] INFO: task syz-executor.4:18020 blocked for more than 140 seconds. [ 2721.897643] Not tainted 4.14.178-syzkaller #0 [ 2721.902944] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2721.910893] syz-executor.4 D29904 18020 6374 0x00000004 [ 2721.916579] Call Trace: [ 2721.919179] ? __schedule+0x7b8/0x1ca0 [ 2721.923118] ? __mutex_lock+0x737/0x1470 [ 2721.927176] ? __sched_text_start+0x8/0x8 [ 2721.931304] ? lock_downgrade+0x6e0/0x6e0 [ 2721.935516] schedule+0x8d/0x1b0 [ 2721.938885] schedule_preempt_disabled+0xf/0x20 [ 2721.943628] __mutex_lock+0x73c/0x1470 [ 2721.947516] ? ctrl_cdev_ioctl+0x142/0x220 [ 2721.951734] ? mutex_trylock+0x1a0/0x1a0 [ 2721.955862] ? __might_fault+0x104/0x1b0 [ 2721.959919] ? lock_acquire+0x170/0x3f0 [ 2721.963962] ? ctrl_cdev_ioctl+0x142/0x220 [ 2721.968197] ctrl_cdev_ioctl+0x142/0x220 [ 2721.972246] ? vol_cdev_llseek+0x140/0x140 [ 2721.976554] ? selinux_file_ioctl+0x3f7/0x560 [ 2721.981041] ? vol_cdev_llseek+0x140/0x140 [ 2721.985335] do_vfs_ioctl+0x75a/0xfe0 [ 2721.989131] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2721.993954] ? ioctl_preallocate+0x1a0/0x1a0 [ 2721.998379] ? security_file_ioctl+0x76/0xb0 [ 2722.002842] ? security_file_ioctl+0x83/0xb0 [ 2722.007332] SyS_ioctl+0x7f/0xb0 [ 2722.010713] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2722.014736] do_syscall_64+0x1d5/0x640 [ 2722.018631] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2722.023886] RIP: 0033:0x45c829 [ 2722.027067] RSP: 002b:00007f3eb435ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2722.034828] RAX: ffffffffffffffda RBX: 00000000004e0d80 RCX: 000000000045c829 [ 2722.042092] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000004 [ 2722.049404] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2722.056736] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2722.064069] R13: 0000000000000209 R14: 00000000004c42c1 R15: 00007f3eb435f6d4 [ 2722.071372] INFO: task syz-executor.5:18014 blocked for more than 140 seconds. [ 2722.078778] Not tainted 4.14.178-syzkaller #0 [ 2722.083862] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2722.091811] syz-executor.5 D29904 18014 31677 0x00000004 [ 2722.097493] Call Trace: [ 2722.100090] ? __schedule+0x7b8/0x1ca0 [ 2722.104046] ? __mutex_lock+0x737/0x1470 [ 2722.108106] ? __sched_text_start+0x8/0x8 [ 2722.112234] ? lock_downgrade+0x6e0/0x6e0 [ 2722.116435] schedule+0x8d/0x1b0 [ 2722.119792] schedule_preempt_disabled+0xf/0x20 [ 2722.124515] __mutex_lock+0x73c/0x1470 [ 2722.128412] ? lock_downgrade+0x6e0/0x6e0 [ 2722.132573] ? mutex_trylock+0x1a0/0x1a0 [ 2722.136701] ? ctrl_cdev_ioctl+0x190/0x220 [ 2722.140929] ? mutex_trylock+0x1a0/0x1a0 [ 2722.145100] ? __get_mtd_device+0x130/0x130 [ 2722.149420] ? __might_fault+0x177/0x1b0 [ 2722.153551] ? ctrl_cdev_ioctl+0x190/0x220 [ 2722.157791] ctrl_cdev_ioctl+0x190/0x220 [ 2722.161839] ? vol_cdev_llseek+0x140/0x140 [ 2722.166127] ? selinux_file_ioctl+0x3f7/0x560 [ 2722.170614] ? vol_cdev_llseek+0x140/0x140 [ 2722.174919] do_vfs_ioctl+0x75a/0xfe0 [ 2722.178716] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2722.183547] ? ioctl_preallocate+0x1a0/0x1a0 [ 2722.187954] ? security_file_ioctl+0x76/0xb0 [ 2722.192339] ? security_file_ioctl+0x83/0xb0 [ 2722.196802] SyS_ioctl+0x7f/0xb0 [ 2722.200177] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2722.204202] do_syscall_64+0x1d5/0x640 [ 2722.208091] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2722.213322] RIP: 0033:0x45c829 [ 2722.216501] RSP: 002b:00007fa3be5d1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2722.224318] RAX: ffffffffffffffda RBX: 00000000004e0d80 RCX: 000000000045c829 [ 2722.231596] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000003 [ 2722.238923] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2722.246259] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2722.253622] R13: 0000000000000209 R14: 00000000004c42c1 R15: 00007fa3be5d26d4 [ 2722.260908] INFO: task syz-executor.5:18019 blocked for more than 140 seconds. [ 2722.268334] Not tainted 4.14.178-syzkaller #0 [ 2722.273399] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2722.281352] syz-executor.5 D29904 18019 31677 0x00000004 [ 2722.287024] Call Trace: [ 2722.289604] ? __schedule+0x7b8/0x1ca0 [ 2722.293555] ? __mutex_lock+0x737/0x1470 [ 2722.297618] ? __sched_text_start+0x8/0x8 [ 2722.301751] ? lock_downgrade+0x6e0/0x6e0 [ 2722.305957] schedule+0x8d/0x1b0 [ 2722.309316] schedule_preempt_disabled+0xf/0x20 [ 2722.314045] __mutex_lock+0x73c/0x1470 [ 2722.317938] ? ctrl_cdev_ioctl+0x142/0x220 [ 2722.322165] ? mutex_trylock+0x1a0/0x1a0 [ 2722.326294] ? __might_fault+0x104/0x1b0 [ 2722.330350] ? lock_acquire+0x170/0x3f0 [ 2722.334405] ? ctrl_cdev_ioctl+0x142/0x220 [ 2722.338636] ctrl_cdev_ioctl+0x142/0x220 [ 2722.342753] ? vol_cdev_llseek+0x140/0x140 [ 2722.346992] ? selinux_file_ioctl+0x3f7/0x560 [ 2722.351467] ? vol_cdev_llseek+0x140/0x140 [ 2722.355756] do_vfs_ioctl+0x75a/0xfe0 [ 2722.359551] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2722.364360] ? ioctl_preallocate+0x1a0/0x1a0 [ 2722.368767] ? security_file_ioctl+0x76/0xb0 [ 2722.373237] ? security_file_ioctl+0x83/0xb0 [ 2722.377649] SyS_ioctl+0x7f/0xb0 [ 2722.381002] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2722.385040] do_syscall_64+0x1d5/0x640 [ 2722.388929] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2722.394178] RIP: 0033:0x45c829 [ 2722.397365] RSP: 002b:00007fa3be5b0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2722.405130] RAX: ffffffffffffffda RBX: 00000000004e0d80 RCX: 000000000045c829 [ 2722.412394] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000004 [ 2722.419706] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2722.427042] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2722.434367] R13: 0000000000000209 R14: 00000000004c42c1 R15: 00007fa3be5b16d4 [ 2722.441658] INFO: task syz-executor.2:18031 blocked for more than 140 seconds. [ 2722.449076] Not tainted 4.14.178-syzkaller #0 [ 2722.454158] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2722.462115] syz-executor.2 D29904 18031 6369 0x00000004 [ 2722.467807] Call Trace: [ 2722.470387] ? __schedule+0x7b8/0x1ca0 [ 2722.474342] ? __mutex_lock+0x737/0x1470 [ 2722.478405] ? __sched_text_start+0x8/0x8 [ 2722.482540] ? lock_downgrade+0x6e0/0x6e0 [ 2722.486752] schedule+0x8d/0x1b0 [ 2722.490112] schedule_preempt_disabled+0xf/0x20 [ 2722.494821] __mutex_lock+0x73c/0x1470 [ 2722.498697] ? lock_downgrade+0x6e0/0x6e0 [ 2722.502899] ? mutex_trylock+0x1a0/0x1a0 [ 2722.506954] ? ctrl_cdev_ioctl+0x190/0x220 [ 2722.511186] ? mutex_trylock+0x1a0/0x1a0 [ 2722.515297] ? __get_mtd_device+0x130/0x130 [ 2722.519607] ? __might_fault+0x177/0x1b0 [ 2722.523731] ? ctrl_cdev_ioctl+0x190/0x220 [ 2722.527978] ctrl_cdev_ioctl+0x190/0x220 [ 2722.532021] ? vol_cdev_llseek+0x140/0x140 [ 2722.536316] ? selinux_file_ioctl+0x3f7/0x560 [ 2722.540800] ? vol_cdev_llseek+0x140/0x140 [ 2722.545124] do_vfs_ioctl+0x75a/0xfe0 [ 2722.548925] ? selinux_file_mprotect+0x5c0/0x5c0 [ 2722.553759] ? ioctl_preallocate+0x1a0/0x1a0 [ 2722.558284] ? security_file_ioctl+0x76/0xb0 [ 2722.562755] ? security_file_ioctl+0x83/0xb0 [ 2722.567157] SyS_ioctl+0x7f/0xb0 [ 2722.570510] ? do_vfs_ioctl+0xfe0/0xfe0 [ 2722.574538] do_syscall_64+0x1d5/0x640 [ 2722.578432] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2722.583676] RIP: 0033:0x45c829 [ 2722.586853] RSP: 002b:00007f903566cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2722.594606] RAX: ffffffffffffffda RBX: 00000000004e0d80 RCX: 000000000045c829 [ 2722.601894] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000003 [ 2722.609220] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2722.616550] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 2722.623941] R13: 0000000000000209 R14: 00000000004c42c1 R15: 00007f903566d6d4 [ 2722.631230] [ 2722.631230] Showing all locks held in the system: [ 2722.637633] 1 lock held by khungtaskd/1056: [ 2722.642375] #0: (tasklist_lock){.+.?}, at: [] debug_show_all_locks+0x7c/0x21a [ 2722.651489] 1 lock held by in:imklog/6052: [ 2722.655796] #0: (&(&(__futex_data.queues)[i].lock)->rlock){+.+.}, at: [] __fdget_pos+0xa6/0xc0 [ 2722.666416] 2 locks held by agetty/6274: [ 2722.670470] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 2722.679462] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 2722.688907] 1 lock held by syz-executor.1/18005: [ 2722.693720] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 2722.702841] 1 lock held by syz-executor.4/18013: [ 2722.707584] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 2722.716672] 1 lock held by syz-executor.4/18020: [ 2722.721412] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 2722.730510] 1 lock held by syz-executor.5/18014: [ 2722.735332] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 2722.744443] 1 lock held by syz-executor.5/18019: [ 2722.749188] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x142/0x220 [ 2722.758255] 1 lock held by syz-executor.2/18031: [ 2722.763095] #0: (ubi_devices_mutex){+.+.}, at: [] ctrl_cdev_ioctl+0x190/0x220 [ 2722.772122] [ 2722.773791] ============================================= [ 2722.773791] [ 2722.780790] NMI backtrace for cpu 0 [ 2722.784488] CPU: 0 PID: 1056 Comm: khungtaskd Not tainted 4.14.178-syzkaller #0 [ 2722.792015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2722.801348] Call Trace: [ 2722.803919] dump_stack+0x13e/0x194 [ 2722.807524] nmi_cpu_backtrace.cold+0x57/0x93 [ 2722.811999] ? irq_force_complete_move.cold+0x7b/0x7b [ 2722.817283] nmi_trigger_cpumask_backtrace+0x139/0x17e [ 2722.822557] watchdog+0x5e2/0xb80 [ 2722.825996] ? hungtask_pm_notify+0x50/0x50 [ 2722.830301] kthread+0x30d/0x420 [ 2722.833654] ? kthread_create_on_node+0xd0/0xd0 [ 2722.838315] ret_from_fork+0x24/0x30 [ 2722.842142] Sending NMI from CPU 0 to CPUs 1: [ 2722.846916] NMI backtrace for cpu 1 [ 2722.846920] CPU: 1 PID: 3631 Comm: systemd-journal Not tainted 4.14.178-syzkaller #0 [ 2722.846924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2722.846927] task: ffff888094744500 task.stack: ffff888094748000 [ 2722.846929] RIP: 0010:link_path_walk+0x3a4/0xed0 [ 2722.846932] RSP: 0018:ffff88809474fb38 EFLAGS: 00000a07 [ 2722.846937] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0001020304050608 [ 2722.846940] RDX: 0000000000000004 RSI: 8d8a9095d0989093 RDI: ffff88809474fc88 [ 2722.846943] RBP: 000000033daf0884 R08: 0000000000000001 R09: 0000000000000001 [ 2722.846946] R10: ffffed10128e9f4a R11: 0000000000000003 R12: ffff88809474fcb4 [ 2722.846949] R13: dffffc0000000000 R14: ffff88809474fc70 R15: ffff88804a7d48a4 [ 2722.846952] FS: 00007f9c09b7d8c0(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 [ 2722.846955] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2722.846958] CR2: 00007f9c04836018 CR3: 00000000947fe000 CR4: 00000000001406e0 [ 2722.846961] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2722.846964] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 2722.846966] Call Trace: [ 2722.846968] ? path_init+0x26e/0x1920 [ 2722.846970] ? walk_component+0x1bc0/0x1bc0 [ 2722.846972] path_parentat.isra.0+0x41/0x150 [ 2722.846974] filename_parentat.isra.0+0x17a/0x3b0 [ 2722.846976] ? getname+0x20/0x20 [ 2722.846979] ? find_held_lock+0x2d/0x110 [ 2722.846981] ? kmem_cache_alloc+0x720/0x770 [ 2722.846983] ? getname_flags+0xc8/0x560 [ 2722.846985] ? check_stack_object+0x86/0xa0 [ 2722.846987] filename_create+0x8a/0x400 [ 2722.846989] ? kern_path_mountpoint+0x40/0x40 [ 2722.846991] ? getname_flags+0x23d/0x560 [ 2722.846993] SyS_mkdir+0x90/0x210 [ 2722.846995] ? SyS_mkdirat+0x210/0x210 [ 2722.846997] ? do_syscall_64+0x4c/0x640 [ 2722.846999] ? SyS_mkdirat+0x210/0x210 [ 2722.847001] do_syscall_64+0x1d5/0x640 [ 2722.847004] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2722.847005] RIP: 0033:0x7f9c08e39687 [ 2722.847008] RSP: 002b:00007ffedb4b7098 EFLAGS: 00000293 ORIG_RAX: 0000000000000053 [ 2722.847013] RAX: ffffffffffffffda RBX: 00007ffedb4b9fb0 RCX: 00007f9c08e39687 [ 2722.847016] RDX: 00007f9c098aaa00 RSI: 00000000000001ed RDI: 000055f1ce8528c0 [ 2722.847019] RBP: 00007ffedb4b70d0 R08: 0000000000000000 R09: 0000000000000000 [ 2722.847022] R10: 0000000000000069 R11: 0000000000000293 R12: 0000000000000000 [ 2722.847025] R13: 0000000000000000 R14: 00007ffedb4b9fb0 R15: 00007ffedb4b75c0 [ 2722.847027] Code: 83 c0 03 38 d0 7c 08 84 d2 0f 85 59 09 00 00 8b 04 24 49 01 df 4c 89 fa 83 e2 07 41 89 46 44 4c 89 f8 48 c1 e8 03 42 0f b6 04 28 <38> d0 7f 08 84 c0 0f 85 24 09 00 00 41 80 3f 00 0f 85 0e 03 00 [ 2722.847682] Kernel panic - not syncing: hung_task: blocked tasks [ 2723.105227] CPU: 0 PID: 1056 Comm: khungtaskd Not tainted 4.14.178-syzkaller #0 [ 2723.112650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2723.122101] Call Trace: [ 2723.124674] dump_stack+0x13e/0x194 [ 2723.128298] panic+0x1f9/0x42d [ 2723.131483] ? add_taint.cold+0x16/0x16 [ 2723.135443] ? irq_force_complete_move.cold+0x7b/0x7b [ 2723.140629] watchdog+0x5f3/0xb80 [ 2723.144151] ? hungtask_pm_notify+0x50/0x50 [ 2723.148450] kthread+0x30d/0x420 [ 2723.151790] ? kthread_create_on_node+0xd0/0xd0 [ 2723.156445] ret_from_fork+0x24/0x30 [ 2723.161395] Kernel Offset: disabled [ 2723.165023] Rebooting in 86400 seconds..