thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:40 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:40 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 130.771508][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 130.777286][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 130.785528][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:43 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 133.801288][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 133.806805][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 133.814961][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 1: timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:44 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 1: timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:44 executing program 1: timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:44 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:44 executing program 4: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:44 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 134.487109][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 134.492698][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 134.501389][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r3, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r4}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:45 executing program 4: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:45 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:45 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:45 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 135.204188][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 135.210200][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 135.218264][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:45 executing program 2: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 135.341413][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 135.347012][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 135.355105][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:45 executing program 4: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:45 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:45 executing program 2: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 135.616581][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 135.622332][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 135.630460][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 135.805337][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 135.811010][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 135.819095][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:47 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:47 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 2: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r3, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r4}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 137.498445][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 137.504025][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 137.512126][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:50 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:50 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r3, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r4}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 140.641733][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 140.647308][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 140.655121][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:53 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:53 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 143.541372][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 143.547224][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 143.555194][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 143.693788][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 143.699857][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 143.707801][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 143.830812][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 143.836457][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 143.844431][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 143.958174][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 143.963760][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 143.971716][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:56 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:56 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:56 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 146.705321][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 146.710921][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 146.719052][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:56 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 146.827399][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 146.832994][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 146.841305][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:43:59 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:43:59 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:59 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:59 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:59 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:43:59 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:00 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:00 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:00 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:01 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:01 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:01 executing program 3: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:02 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:02 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:02 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:02 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:02 executing program 3: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:02 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 152.470974][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 152.476502][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 152.484473][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:03 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:03 executing program 3: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:04 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:04 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:05 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:05 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:05 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:05 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:05 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 155.488773][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 155.496512][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 155.504295][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:06 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:06 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:07 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:07 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:08 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:08 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 06:44:08 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:08 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:08 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 158.532515][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 158.538184][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 158.546258][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:09 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:09 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 06:44:09 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:10 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 06:44:10 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:10 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:11 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 5: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:11 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) [ 161.546111][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 161.552485][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 161.560919][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:11 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:11 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:12 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 06:44:12 executing program 5: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:12 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:14 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:14 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:14 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:14 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:14 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 06:44:14 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) [ 164.561736][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 164.567484][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 164.575613][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:14 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:15 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, r0, 0x3, 0x0) 06:44:15 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 06:44:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 167.578720][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 167.584286][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 167.592497][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:17 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, r0, 0x3, 0x0) 06:44:17 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, r0, 0x3, 0x0) [ 170.616802][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 170.622424][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 170.634584][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, r0, 0x3, 0x0) 06:44:23 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 173.681853][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 173.688200][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 173.702583][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, r0, 0x3, 0x0) 06:44:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 176.745528][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 176.751053][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 176.759282][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 176.926092][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 176.931918][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 176.939895][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:27 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, r0, 0x3, 0x0) 06:44:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 177.774728][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 177.780353][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 177.788452][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:29 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 180.614321][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 180.619827][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 180.627761][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:32 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:32 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:33 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:33 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 183.667175][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 183.672753][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 183.681123][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:35 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:35 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:35 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:35 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x3, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x3, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x3, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r1, 0x3, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r1, 0x3, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) tee(0xffffffffffffffff, r1, 0x3, 0x0) 06:44:35 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r1, 0x3, 0x0) [ 186.678283][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 186.683767][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 186.692536][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:38 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r1, 0x3, 0x0) 06:44:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r1, 0x3, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x3, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x3, 0x0) 06:44:38 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x3, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x0, 0x0) 06:44:38 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:38 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x0, 0x0) 06:44:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:39 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:39 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x0, 0x0) [ 189.687724][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 189.702022][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 189.710135][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:41 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:41 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) 06:44:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:41 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:42 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:42 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:42 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 192.719803][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 192.728062][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 192.736924][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:43 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:43 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 193.574783][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 193.584350][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 193.592508][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 194.430106][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 194.436041][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 194.443945][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:44 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:44 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:44 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:45 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:45 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:45 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 195.736154][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 195.750673][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 195.761427][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:45 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:46 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 196.624248][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 196.629875][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 196.638677][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:47 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:47 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:48 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:48 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:48 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 198.767741][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 198.773907][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 198.790909][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 199.651016][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 199.656927][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 199.664664][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:50 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:50 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 200.978588][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 200.984702][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 200.997022][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 201.025790][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 201.031452][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 201.039542][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:51 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:51 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:51 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 201.841488][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 201.847195][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 201.855031][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:53 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 203.996478][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 204.002292][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 204.010656][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 204.029895][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 204.035731][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 204.045210][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 204.063109][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 204.068876][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 204.078051][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 204.094183][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 204.100100][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 204.108400][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:54 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:54 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:54 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 204.874595][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 204.880136][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 204.888162][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 204.906671][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 204.912122][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 204.920366][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:56 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:56 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r6, r5, 0x3, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:56 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:56 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 207.228303][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 207.234708][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 207.242846][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 207.424297][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 207.430001][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 207.438366][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:57 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 208.117118][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 208.123596][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 208.132030][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:58 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:58 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 208.208501][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 208.215395][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 208.235046][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:44:58 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:44:58 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 208.396519][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 208.402001][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 208.410246][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r6, r5, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140), 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 5: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140), 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 5: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:00 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 211.128712][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 211.135685][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 211.144008][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:01 executing program 5: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 211.286244][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 211.292030][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 211.300264][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140), 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:03 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 214.123811][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 214.129957][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 214.138703][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 214.239825][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 214.245962][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 214.254325][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:04 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 214.347681][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 214.353767][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 214.361808][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 214.680748][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 214.686553][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 214.694521][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:04 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r6, r5, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r2, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r3}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:04 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 214.967936][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 214.973659][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 214.981731][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:04 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 215.174114][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 215.182650][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 215.191470][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 215.346112][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 215.351839][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 215.359938][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:05 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:05 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 215.964001][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 215.969736][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 215.985473][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 216.377859][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 216.383655][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 216.391793][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:06 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 216.612717][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 216.620373][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 216.628726][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:06 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 216.738850][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 216.745339][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 216.754241][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:06 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:06 executing program 0: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 216.917890][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 216.923567][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 216.931728][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:07 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r6, r5, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r2, r3, &(0x7f0000000280)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r0}, 0x0) io_uring_enter(r1, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 0: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 0: r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, 0x0, &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 217.839553][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 217.845168][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 217.853663][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:08 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 218.370160][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 218.376352][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 218.384738][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 218.866761][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 218.872467][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 218.880950][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:08 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 219.260456][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 219.266294][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 219.274492][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:09 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 219.380965][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 219.386970][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 219.395772][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 219.513553][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 219.519581][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 219.539194][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 219.623327][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 219.629132][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 219.637640][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:09 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:09 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 220.203398][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 220.209288][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 220.217611][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:12 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 222.818434][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 222.824010][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 222.832827][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:12 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 223.056251][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 223.062501][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 223.070407][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:13 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:13 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:13 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:13 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:13 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 223.971918][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 223.977707][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 223.985771][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:15 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(0x0) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 2: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r4, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r5}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 225.877534][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 225.895753][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 225.908922][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:15 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:15 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 226.180179][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 226.186571][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 226.194634][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:18 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 2: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r4, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r5}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 2: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r4, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r5}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:18 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 228.994129][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 228.999834][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 229.008054][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 229.223486][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 229.229092][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 229.245374][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:21 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:21 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 232.009833][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 232.015530][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 232.023597][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:24 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 4: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r4, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 4: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r4, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 4: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r4, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:24 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 235.641708][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 235.647698][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 235.655809][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:27 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:45:27 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 238.040713][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 238.046573][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 238.054689][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:28 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:28 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:28 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 238.527836][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 238.533423][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 238.542459][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:30 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 2: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x3, &(0x7f0000000040)=[{0x15, 0x0, 0x0, 0x200}, {0x0, 0x0, 0x0, 0x4}, {0x6, 0x0, 0x0, 0x7ffffdbf}]}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) 06:45:30 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 240.837462][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 240.843177][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 240.851472][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x30, r6, 0x1e13f000) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x30, r6, 0x1e13f000) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:30 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:31 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:31 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 241.874646][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 241.880355][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 241.888538][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:33 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x30, r6, 0x1e13f000) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x4, 0x7, 0x0, 0x0, 0x1}, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x30, r6, 0x1e13f000) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:33 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:34 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:34 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:34 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:34 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 244.701647][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 244.707327][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 244.715325][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:36 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:36 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:36 executing program 2: ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000058c40)={0x0, [{0x0}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}], 0x0, "2156816c73038c"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000200)={0x0, ""/256, 0x0, 0x0}) r287 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r288 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r288, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r287, 0x81f8943c, &(0x7f0000000640)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r288, 0xd000943d, &(0x7f0000047d40)={0x6, [{r207, r192}, {}, {0x0, r283}, {r197, r104}, {r108}, {}, {r105, r200}, {0x0, r74}, {0x0, r256}, {0x0, r243}, {r269, r187}, {r57}, {r36, r44}, {}, {}, {r145, r51}, {}, {r92, r265}, {}, {r100}, {0x0, r6}, {0x0, r181}, {r183}, {0x0, r31}, {0x0, r56}, {0x0, r265}, {0x0, r263}, {r70}, {0x0, r241}, {r97, r91}, {r122}, {r120}, {}, {r230, r91}, {0x0, r22}, {0x0, r238}, {0x0, r256}, {r239, r259}, {0x0, r194}, {}, {r226, r129}, {r252, r5}, {r82}, {r197, r98}, {}, {}, {}, {}, {0x0, r11}, {}, {}, {r204}, {}, {r27, r111}, {}, {r224, r125}, {0x0, r23}, {r166}, {0x0, r69}, {}, {r42, r253}, {r77}, {0x0, r225}, {0x0, r202}, {r8, r11}, {0x0, r49}, {r207, r139}, {0x0, r273}, {}, {0x0, r202}, {0x0, r111}, {0x0, r34}, {0x0, r261}, {r276, r124}, {r47, r39}, {0x0, r263}, {0x0, r199}, {}, {}, {r230, r214}, {}, {r219, r131}, {r19, r39}, {}, {0x0, r261}, {}, {0x0, r158}, {0x0, r62}, {0x0, 0x0}, {}, {r122, r117}, {0x0, r83}, {0x0, r118}, {0x0, r203}, {r149}, {r122}, {r154}, {r2}, {r38}, {}, {}, {}, {0x0, r54}, {0x0, r189}, {0x0, r144}, {r163, r71}, {r93, r167}, {r140, r218}, {r188}, {0x0, r117}, {r12, r22}, {r14, r186}, {r70, r9}, {r143}, {}, {}, {r36}, {r285}, {0x0, r231}, {}, {0x0, r262}, {}, {}, {0x0, r20}, {}, {r185}, {}, {}, {0x0, r107}, {0x0, r127}, {}, {0x0, r167}, {}, {0x0, r104}, {r90}, {0x0, r170}, {0x0, r37}, {r174, r107}, {r290}, {}, {0x0, r280}, {r65}, {}, {}, {r183, r48}, {r266}, {}, {}, {}, {0x0, r134}, {}, {}, {}, {}, {r12, r16}, {}, {r43}, {r279}, {0x0, r98}, {r264, r173}, {}, {0x0, r116}, {}, {r195, r51}, {r102, r278}, {0x0, r67}, {r161}, {0x0, r208}, {r191}, {r29, r111}, {r268}, {r18}, {0x0, r248}, {r224, r291}, {r281}, {0x0, r71}, {r26}, {}, {0x0, r56}, {r285}, {r18}, {0x0, r60}, {r95, r78}, {}, {r119}, {0x0, r11}, {r247}, {r213, r205}, {r232}, {0x0, r79}, {r216}, {r128}, {r59, r234}, {}, {0x0, r17}, {0x0, r179}, {}, {}, {r240}, {}, {0x0, r270}, {}, {0x0, r270}, {}, {0x0, r6}, {}, {r115}, {r184, r280}, {0x0, r129}, {}, {r33}, {0x0, r86}, {r133}, {0x0, r41}, {}, {0x0, r271}, {0x0, r193}, {0x0, r125}, {r159, r155}, {}, {0x0, r132}, {r136, r109}, {r217}, {}, {r282, r245}, {r136}, {r185}, {r195}, {}, {r166, r277}, {r176, r251}, {r221, r76}, {r211, r75}, {}, {r138, r58}, {0x0, r277}, {r119, r200}, {}, {r110, r262}, {r209}, {0x0, r280}, {}, {}, {0x0, r76}, {}, {0x0, r151}, {r126}, {r26}, {}, {0x0, r35}, {}, {r0}, {}, {r240}], 0x0, "1fa453873abbec"}) r296 = socket$inet6(0xa, 0x0, 0x7) getsockopt$IP6T_SO_GET_REVISION_MATCH(r296, 0x29, 0xb, 0x0, &(0x7f0000000040)) r297 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r297, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r297, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000640)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r287, 0xd000943d, &(0x7f0000058c40)={0x1, [{0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {}, {0x0}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0}, {0x0, r293}, {r240}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, r291}, {0x0, r294}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0}, {}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0}, {}, {0x0}, {r295}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {r300}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0}, {r298}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {}, {}, {0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {0x0, 0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}], 0x1, "2156816c73038c"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r287, 0xd000943d, &(0x7f0000000d00)={0x2, [{r453, r94}, {r171, r227}, {r474, r175}, {r247, r192}, {r452, r346}, {r24}, {r344, r424}, {r228, r182}, {r322, r328}, {r482, r66}, {r284}, {r211, r214}, {r143}, {r53, r408}, {r322, r372}, {r1, r407}, {r433, r114}, {r370, r479}, {0x0, r440}, {r184, r127}, {r198, r366}, {r336, r274}, {r42, r246}, {r339}, {r386, r173}, {r452, r459}, {0x0, r333}, {r242, r81}, {r255, r350}, {r467}, {r374, r316}, {r423, r410}, {r133, r113}, {r390, r387}, {r485, r99}, {r343, r291}, {r465, r223}, {r383, r235}, {r432, r50}, {r195, r408}, {r195, r434}, {r313, r15}, {0x0, r15}, {r314}, {r460, r337}, {r260, r435}, {r224}, {r446, r63}, {r242, r72}, {r373, r79}, {r413, r445}, {r300, r481}, {r141, r164}, {r431, r476}, {r26, r167}, {r486, r4}, {r272, r484}, {r323, r192}, {r68, r385}, {r47, r225}, {r355, r437}, {r123, r475}, {r40}, {r335, r165}, {r348, r470}, {r195, r469}, {r21, r416}, {r414, r358}, {r332}, {r169, r320}, {r414, r54}, {r473, r62}, {r315, r267}, {r342}, {r87, r112}, {r438, r306}, {r73, r86}, {r230, r258}, {r393, r454}, {r433, r60}, {r345, r417}, {r338, r248}, {r347}, {r425, r227}, {r2}, {r419, r146}, {r53, r103}, {r18, r222}, {r458, r275}, {r150, r257}, {r364, r187}, {r108, r214}, {r405, r418}, {r364, r199}, {r376, r66}, {r379, r237}, {r412, r267}, {r359, r435}, {r319, r392}, {r85, r329}, {0x0, r88}, {r305, r391}, {r489, r415}, {r185, r91}, {r467, r411}, {r371, r277}, {r215, r147}, {r18, r208}, {r421, r63}, {r419, r437}, {r441, r450}, {0x0, r220}, {r388, r45}, {r289, r357}, {r133, r233}, {r394, r167}, {r377, r301}, {r156, r293}, {r343}, {r326, r353}, {r224, r13}, {r115, r267}, {r330, r249}, {r64, r243}, {r156, r331}, {r311, r325}, {r395, r354}, {r302, r236}, {r362, r309}, {r307, r104}, {r52, r39}, {0x0, r106}, {r43, r210}, {0x0, r132}, {r255, r121}, {r178, r3}, {r160, r490}, {r356, r447}, {r321, r200}, {r10, r396}, {r443, r420}, {r412, r401}, {0x0, r256}, {r478, r257}, {r2, r96}, {r409, r89}, {r456, r31}, {}, {r426, r192}, {r364, r206}, {r365, r358}, {r432, r399}, {r292, r470}, {r178}, {r339, r30}, {r154, r341}, {r322, r245}, {r18}, {r351, r28}, {r176}, {r244, r116}, {r327, r127}, {r368, r172}, {r196, r407}, {r102, r125}, {r152, r101}, {r390, r286}, {r232, r11}, {r468, r235}, {r61, r84}, {r178, r334}, {r444, r490}, {r361, r291}, {r398}, {r400, r177}, {r375, r317}, {r403, r7}, {r480, r487}, {r180, r308}, {r471, r111}, {r436, r170}, {}, {r464, r20}, {r455}, {r397, r208}, {r442, r382}, {r413, r263}, {r154, r457}, {r135, r312}, {r180, r45}, {}, {r422, r303}, {r361, r157}, {r336, r381}, {r349, r451}, {r254, r245}, {}, {r315, r417}, {r438, r472}, {r395, r299}, {r409}, {r448, r402}, {r461, r41}, {r215, r318}, {0x0, r201}, {r432, r304}, {0x0, r418}, {0x0, r334}, {r215, r233}, {r413, r406}, {r128, r248}, {r120, r384}, {r340, r427}, {r190}, {r80, r404}, {r397}, {r449, r380}, {r352}, {r14, r360}, {r43, r212}, {r302, r7}, {r43, r146}, {r135, r378}, {r168, r389}, {r130, r148}, {r61}, {r367, r142}, {r462, r357}, {0x0, r369}, {r250, r363}, {r178, r391}, {r314, r430}, {r313, r439}, {r348, r466}, {r377, r46}, {0x0, r162}, {}, {r377}, {r77, r203}, {0x0, r137}, {r123, r153}, {r342, r32}, {r398, r428}, {r446}, {0x0, r238}, {r483, r477}, {r338, r25}, {r488, r229}, {r429, r301}, {r24, r372}, {0x0, r324}, {r190, r30}, {0x0, r329}, {r55, r310}, {r242, r463}], 0x2, "c618147ed5ecf1"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000546c0)={0x0, [{0x0, r157}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r491}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r291}, {r285}, {}, {}, {}, {}, {}, {}, {}, {0x0, r248}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r390}], 0x0, "e72c184cca3d07"}) r492 = memfd_create(&(0x7f0000000900)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x84\xcdN\xf7\xf6\b~\xed_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xdcLF\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8o8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd930x0}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}], 0x0, "2156816c73038c"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000200)={0x0, ""/256, 0x0, 0x0}) r287 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r288 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r288, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r287, 0x81f8943c, &(0x7f0000000640)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r288, 0xd000943d, &(0x7f0000047d40)={0x6, [{r207, r192}, {}, {0x0, r283}, {r197, r104}, {r108}, {}, {r105, r200}, {0x0, r74}, {0x0, r256}, {0x0, r243}, {r269, r187}, {r57}, {r36, r44}, {}, {}, {r145, r51}, {}, {r92, r265}, {}, {r100}, {0x0, r6}, {0x0, r181}, {r183}, {0x0, r31}, {0x0, r56}, {0x0, r265}, {0x0, r263}, {r70}, {0x0, r241}, {r97, r91}, {r122}, {r120}, {}, {r230, r91}, {0x0, r22}, {0x0, r238}, {0x0, r256}, {r239, r259}, {0x0, r194}, {}, {r226, r129}, {r252, r5}, {r82}, {r197, r98}, {}, {}, {}, {}, {0x0, r11}, {}, {}, {r204}, {}, {r27, r111}, {}, {r224, r125}, {0x0, r23}, {r166}, {0x0, r69}, {}, {r42, r253}, {r77}, {0x0, r225}, {0x0, r202}, {r8, r11}, {0x0, r49}, {r207, r139}, {0x0, r273}, {}, {0x0, r202}, {0x0, r111}, {0x0, r34}, {0x0, r261}, {r276, r124}, {r47, r39}, {0x0, r263}, {0x0, r199}, {}, {}, {r230, r214}, {}, {r219, r131}, {r19, r39}, {}, {0x0, r261}, {}, {0x0, r158}, {0x0, r62}, {0x0, 0x0}, {}, {r122, r117}, {0x0, r83}, {0x0, r118}, {0x0, r203}, {r149}, {r122}, {r154}, {r2}, {r38}, {}, {}, {}, {0x0, r54}, {0x0, r189}, {0x0, r144}, {r163, r71}, {r93, r167}, {r140, r218}, {r188}, {0x0, r117}, {r12, r22}, {r14, r186}, {r70, r9}, {r143}, {}, {}, {r36}, {r285}, {0x0, r231}, {}, {0x0, r262}, {}, {}, {0x0, r20}, {}, {r185}, {}, {}, {0x0, r107}, {0x0, r127}, {}, {0x0, r167}, {}, {0x0, r104}, {r90}, {0x0, r170}, {0x0, r37}, {r174, r107}, {r290}, {}, {0x0, r280}, {r65}, {}, {}, {r183, r48}, {r266}, {}, {}, {}, {0x0, r134}, {}, {}, {}, {}, {r12, r16}, {}, {r43}, {r279}, {0x0, r98}, {r264, r173}, {}, {0x0, r116}, {}, {r195, r51}, {r102, r278}, {0x0, r67}, {r161}, {0x0, r208}, {r191}, {r29, r111}, {r268}, {r18}, {0x0, r248}, {r224, r291}, {r281}, {0x0, r71}, {r26}, {}, {0x0, r56}, {r285}, {r18}, {0x0, r60}, {r95, r78}, {}, {r119}, {0x0, r11}, {r247}, {r213, r205}, {r232}, {0x0, r79}, {r216}, {r128}, {r59, r234}, {}, {0x0, r17}, {0x0, r179}, {}, {}, {r240}, {}, {0x0, r270}, {}, {0x0, r270}, {}, {0x0, r6}, {}, {r115}, {r184, r280}, {0x0, r129}, {}, {r33}, {0x0, r86}, {r133}, {0x0, r41}, {}, {0x0, r271}, {0x0, r193}, {0x0, r125}, {r159, r155}, {}, {0x0, r132}, {r136, r109}, {r217}, {}, {r282, r245}, {r136}, {r185}, {r195}, {}, {r166, r277}, {r176, r251}, {r221, r76}, {r211, r75}, {}, {r138, r58}, {0x0, r277}, {r119, r200}, {}, {r110, r262}, {r209}, {0x0, r280}, {}, {}, {0x0, r76}, {}, {0x0, r151}, {r126}, {r26}, {}, {0x0, r35}, {}, {r0}, {}, {r240}], 0x0, "1fa453873abbec"}) r296 = socket$inet6(0xa, 0x0, 0x7) getsockopt$IP6T_SO_GET_REVISION_MATCH(r296, 0x29, 0xb, 0x0, &(0x7f0000000040)) r297 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r297, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r297, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000640)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r287, 0xd000943d, &(0x7f0000058c40)={0x1, [{0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {}, {0x0}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0}, {0x0, r293}, {r240}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, r291}, {0x0, r294}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0}, {}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0}, {}, {0x0}, {r295}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {r300}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0}, {r298}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {}, {}, {0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {0x0, 0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}], 0x1, "2156816c73038c"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r287, 0xd000943d, &(0x7f0000000d00)={0x2, [{r453, r94}, {r171, r227}, {r474, r175}, {r247, r192}, {r452, r346}, {r24}, {r344, r424}, {r228, r182}, {r322, r328}, {r482, r66}, {r284}, {r211, r214}, {r143}, {r53, r408}, {r322, r372}, {r1, r407}, {r433, r114}, {r370, r479}, {0x0, r440}, {r184, r127}, {r198, r366}, {r336, r274}, {r42, r246}, {r339}, {r386, r173}, {r452, r459}, {0x0, r333}, {r242, r81}, {r255, r350}, {r467}, {r374, r316}, {r423, r410}, {r133, r113}, {r390, r387}, {r485, r99}, {r343, r291}, {r465, r223}, {r383, r235}, {r432, r50}, {r195, r408}, {r195, r434}, {r313, r15}, {0x0, r15}, {r314}, {r460, r337}, {r260, r435}, {r224}, {r446, r63}, {r242, r72}, {r373, r79}, {r413, r445}, {r300, r481}, {r141, r164}, {r431, r476}, {r26, r167}, {r486, r4}, {r272, r484}, {r323, r192}, {r68, r385}, {r47, r225}, {r355, r437}, {r123, r475}, {r40}, {r335, r165}, {r348, r470}, {r195, r469}, {r21, r416}, {r414, r358}, {r332}, {r169, r320}, {r414, r54}, {r473, r62}, {r315, r267}, {r342}, {r87, r112}, {r438, r306}, {r73, r86}, {r230, r258}, {r393, r454}, {r433, r60}, {r345, r417}, {r338, r248}, {r347}, {r425, r227}, {r2}, {r419, r146}, {r53, r103}, {r18, r222}, {r458, r275}, {r150, r257}, {r364, r187}, {r108, r214}, {r405, r418}, {r364, r199}, {r376, r66}, {r379, r237}, {r412, r267}, {r359, r435}, {r319, r392}, {r85, r329}, {0x0, r88}, {r305, r391}, {r489, r415}, {r185, r91}, {r467, r411}, {r371, r277}, {r215, r147}, {r18, r208}, {r421, r63}, {r419, r437}, {r441, r450}, {0x0, r220}, {r388, r45}, {r289, r357}, {r133, r233}, {r394, r167}, {r377, r301}, {r156, r293}, {r343}, {r326, r353}, {r224, r13}, {r115, r267}, {r330, r249}, {r64, r243}, {r156, r331}, {r311, r325}, {r395, r354}, {r302, r236}, {r362, r309}, {r307, r104}, {r52, r39}, {0x0, r106}, {r43, r210}, {0x0, r132}, {r255, r121}, {r178, r3}, {r160, r490}, {r356, r447}, {r321, r200}, {r10, r396}, {r443, r420}, {r412, r401}, {0x0, r256}, {r478, r257}, {r2, r96}, {r409, r89}, {r456, r31}, {}, {r426, r192}, {r364, r206}, {r365, r358}, {r432, r399}, {r292, r470}, {r178}, {r339, r30}, {r154, r341}, {r322, r245}, {r18}, {r351, r28}, {r176}, {r244, r116}, {r327, r127}, {r368, r172}, {r196, r407}, {r102, r125}, {r152, r101}, {r390, r286}, {r232, r11}, {r468, r235}, {r61, r84}, {r178, r334}, {r444, r490}, {r361, r291}, {r398}, {r400, r177}, {r375, r317}, {r403, r7}, {r480, r487}, {r180, r308}, {r471, r111}, {r436, r170}, {}, {r464, r20}, {r455}, {r397, r208}, {r442, r382}, {r413, r263}, {r154, r457}, {r135, r312}, {r180, r45}, {}, {r422, r303}, {r361, r157}, {r336, r381}, {r349, r451}, {r254, r245}, {}, {r315, r417}, {r438, r472}, {r395, r299}, {r409}, {r448, r402}, {r461, r41}, {r215, r318}, {0x0, r201}, {r432, r304}, {0x0, r418}, {0x0, r334}, {r215, r233}, {r413, r406}, {r128, r248}, {r120, r384}, {r340, r427}, {r190}, {r80, r404}, {r397}, {r449, r380}, {r352}, {r14, r360}, {r43, r212}, {r302, r7}, {r43, r146}, {r135, r378}, {r168, r389}, {r130, r148}, {r61}, {r367, r142}, {r462, r357}, {0x0, r369}, {r250, r363}, {r178, r391}, {r314, r430}, {r313, r439}, {r348, r466}, {r377, r46}, {0x0, r162}, {}, {r377}, {r77, r203}, {0x0, r137}, {r123, r153}, {r342, r32}, {r398, r428}, {r446}, {0x0, r238}, {r483, r477}, {r338, r25}, {r488, r229}, {r429, r301}, {r24, r372}, {0x0, r324}, {r190, r30}, {0x0, r329}, {r55, r310}, {r242, r463}], 0x2, "c618147ed5ecf1"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000546c0)={0x0, [{0x0, r157}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r491}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r291}, {r285}, {}, {}, {}, {}, {}, {}, {}, {0x0, r248}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r390}], 0x0, "e72c184cca3d07"}) r492 = memfd_create(&(0x7f0000000900)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x84\xcdN\xf7\xf6\b~\xed_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xdcLF\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8o8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd930x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 246.863873][ C0] scsi_io_completion_action: 1 callbacks suppressed [ 246.863899][ C0] sd 0:0:1:0: tag#1293 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 246.864391][ C1] sd 0:0:1:0: tag#1294 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 246.870543][ C0] sd 0:0:1:0: tag#1293 CDB: opcode=0xe5 (vendor) [ 246.870564][ C0] sd 0:0:1:0: tag#1293 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 246.880534][ C1] sd 0:0:1:0: tag#1294 CDB: opcode=0xe5 (vendor) [ 246.890551][ C0] sd 0:0:1:0: tag#1293 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 246.896854][ C1] sd 0:0:1:0: tag#1294 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 246.905944][ C0] sd 0:0:1:0: tag#1293 CDB[20]: ba [ 246.912262][ C1] sd 0:0:1:0: tag#1294 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 246.912278][ C1] sd 0:0:1:0: tag#1294 CDB[20]: ba [ 246.955215][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 246.961063][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 246.969242][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:36 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:36 executing program 2: ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000058c40)={0x0, [{0x0}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}], 0x0, "2156816c73038c"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000200)={0x0, ""/256, 0x0, 0x0}) r287 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r288 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r288, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r287, 0x81f8943c, &(0x7f0000000640)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r288, 0xd000943d, &(0x7f0000047d40)={0x6, [{r207, r192}, {}, {0x0, r283}, {r197, r104}, {r108}, {}, {r105, r200}, {0x0, r74}, {0x0, r256}, {0x0, r243}, {r269, r187}, {r57}, {r36, r44}, {}, {}, {r145, r51}, {}, {r92, r265}, {}, {r100}, {0x0, r6}, {0x0, r181}, {r183}, {0x0, r31}, {0x0, r56}, {0x0, r265}, {0x0, r263}, {r70}, {0x0, r241}, {r97, r91}, {r122}, {r120}, {}, {r230, r91}, {0x0, r22}, {0x0, r238}, {0x0, r256}, {r239, r259}, {0x0, r194}, {}, {r226, r129}, {r252, r5}, {r82}, {r197, r98}, {}, {}, {}, {}, {0x0, r11}, {}, {}, {r204}, {}, {r27, r111}, {}, {r224, r125}, {0x0, r23}, {r166}, {0x0, r69}, {}, {r42, r253}, {r77}, {0x0, r225}, {0x0, r202}, {r8, r11}, {0x0, r49}, {r207, r139}, {0x0, r273}, {}, {0x0, r202}, {0x0, r111}, {0x0, r34}, {0x0, r261}, {r276, r124}, {r47, r39}, {0x0, r263}, {0x0, r199}, {}, {}, {r230, r214}, {}, {r219, r131}, {r19, r39}, {}, {0x0, r261}, {}, {0x0, r158}, {0x0, r62}, {0x0, 0x0}, {}, {r122, r117}, {0x0, r83}, {0x0, r118}, {0x0, r203}, {r149}, {r122}, {r154}, {r2}, {r38}, {}, {}, {}, {0x0, r54}, {0x0, r189}, {0x0, r144}, {r163, r71}, {r93, r167}, {r140, r218}, {r188}, {0x0, r117}, {r12, r22}, {r14, r186}, {r70, r9}, {r143}, {}, {}, {r36}, {r285}, {0x0, r231}, {}, {0x0, r262}, {}, {}, {0x0, r20}, {}, {r185}, {}, {}, {0x0, r107}, {0x0, r127}, {}, {0x0, r167}, {}, {0x0, r104}, {r90}, {0x0, r170}, {0x0, r37}, {r174, r107}, {r290}, {}, {0x0, r280}, {r65}, {}, {}, {r183, r48}, {r266}, {}, {}, {}, {0x0, r134}, {}, {}, {}, {}, {r12, r16}, {}, {r43}, {r279}, {0x0, r98}, {r264, r173}, {}, {0x0, r116}, {}, {r195, r51}, {r102, r278}, {0x0, r67}, {r161}, {0x0, r208}, {r191}, {r29, r111}, {r268}, {r18}, {0x0, r248}, {r224, r291}, {r281}, {0x0, r71}, {r26}, {}, {0x0, r56}, {r285}, {r18}, {0x0, r60}, {r95, r78}, {}, {r119}, {0x0, r11}, {r247}, {r213, r205}, {r232}, {0x0, r79}, {r216}, {r128}, {r59, r234}, {}, {0x0, r17}, {0x0, r179}, {}, {}, {r240}, {}, {0x0, r270}, {}, {0x0, r270}, {}, {0x0, r6}, {}, {r115}, {r184, r280}, {0x0, r129}, {}, {r33}, {0x0, r86}, {r133}, {0x0, r41}, {}, {0x0, r271}, {0x0, r193}, {0x0, r125}, {r159, r155}, {}, {0x0, r132}, {r136, r109}, {r217}, {}, {r282, r245}, {r136}, {r185}, {r195}, {}, {r166, r277}, {r176, r251}, {r221, r76}, {r211, r75}, {}, {r138, r58}, {0x0, r277}, {r119, r200}, {}, {r110, r262}, {r209}, {0x0, r280}, {}, {}, {0x0, r76}, {}, {0x0, r151}, {r126}, {r26}, {}, {0x0, r35}, {}, {r0}, {}, {r240}], 0x0, "1fa453873abbec"}) r296 = socket$inet6(0xa, 0x0, 0x7) getsockopt$IP6T_SO_GET_REVISION_MATCH(r296, 0x29, 0xb, 0x0, &(0x7f0000000040)) r297 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r297, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r297, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000640)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r287, 0xd000943d, &(0x7f0000058c40)={0x1, [{0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {}, {0x0}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {0x0}, {0x0, r293}, {r240}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, r291}, {0x0, r294}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0}, {}, {}, {}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {}, {0x0}, {0x0}, {}, {0x0}, {r295}, {0x0, 0x0}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {0x0, 0x0}, {0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {r300}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0}, {0x0, 0x0}, {}, {0x0}, {r298}, {}, {0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {}, {}, {}, {}, {0x0}, {}, {0x0}, {0x0, 0x0}, {0x0}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0}, {0x0}, {0x0, 0x0}, {}, {}, {}, {0x0, 0x0}, {}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {0x0, 0x0}, {}, {0x0}, {0x0}, {0x0, 0x0}], 0x1, "2156816c73038c"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r287, 0xd000943d, &(0x7f0000000d00)={0x2, [{r453, r94}, {r171, r227}, {r474, r175}, {r247, r192}, {r452, r346}, {r24}, {r344, r424}, {r228, r182}, {r322, r328}, {r482, r66}, {r284}, {r211, r214}, {r143}, {r53, r408}, {r322, r372}, {r1, r407}, {r433, r114}, {r370, r479}, {0x0, r440}, {r184, r127}, {r198, r366}, {r336, r274}, {r42, r246}, {r339}, {r386, r173}, {r452, r459}, {0x0, r333}, {r242, r81}, {r255, r350}, {r467}, {r374, r316}, {r423, r410}, {r133, r113}, {r390, r387}, {r485, r99}, {r343, r291}, {r465, r223}, {r383, r235}, {r432, r50}, {r195, r408}, {r195, r434}, {r313, r15}, {0x0, r15}, {r314}, {r460, r337}, {r260, r435}, {r224}, {r446, r63}, {r242, r72}, {r373, r79}, {r413, r445}, {r300, r481}, {r141, r164}, {r431, r476}, {r26, r167}, {r486, r4}, {r272, r484}, {r323, r192}, {r68, r385}, {r47, r225}, {r355, r437}, {r123, r475}, {r40}, {r335, r165}, {r348, r470}, {r195, r469}, {r21, r416}, {r414, r358}, {r332}, {r169, r320}, {r414, r54}, {r473, r62}, {r315, r267}, {r342}, {r87, r112}, {r438, r306}, {r73, r86}, {r230, r258}, {r393, r454}, {r433, r60}, {r345, r417}, {r338, r248}, {r347}, {r425, r227}, {r2}, {r419, r146}, {r53, r103}, {r18, r222}, {r458, r275}, {r150, r257}, {r364, r187}, {r108, r214}, {r405, r418}, {r364, r199}, {r376, r66}, {r379, r237}, {r412, r267}, {r359, r435}, {r319, r392}, {r85, r329}, {0x0, r88}, {r305, r391}, {r489, r415}, {r185, r91}, {r467, r411}, {r371, r277}, {r215, r147}, {r18, r208}, {r421, r63}, {r419, r437}, {r441, r450}, {0x0, r220}, {r388, r45}, {r289, r357}, {r133, r233}, {r394, r167}, {r377, r301}, {r156, r293}, {r343}, {r326, r353}, {r224, r13}, {r115, r267}, {r330, r249}, {r64, r243}, {r156, r331}, {r311, r325}, {r395, r354}, {r302, r236}, {r362, r309}, {r307, r104}, {r52, r39}, {0x0, r106}, {r43, r210}, {0x0, r132}, {r255, r121}, {r178, r3}, {r160, r490}, {r356, r447}, {r321, r200}, {r10, r396}, {r443, r420}, {r412, r401}, {0x0, r256}, {r478, r257}, {r2, r96}, {r409, r89}, {r456, r31}, {}, {r426, r192}, {r364, r206}, {r365, r358}, {r432, r399}, {r292, r470}, {r178}, {r339, r30}, {r154, r341}, {r322, r245}, {r18}, {r351, r28}, {r176}, {r244, r116}, {r327, r127}, {r368, r172}, {r196, r407}, {r102, r125}, {r152, r101}, {r390, r286}, {r232, r11}, {r468, r235}, {r61, r84}, {r178, r334}, {r444, r490}, {r361, r291}, {r398}, {r400, r177}, {r375, r317}, {r403, r7}, {r480, r487}, {r180, r308}, {r471, r111}, {r436, r170}, {}, {r464, r20}, {r455}, {r397, r208}, {r442, r382}, {r413, r263}, {r154, r457}, {r135, r312}, {r180, r45}, {}, {r422, r303}, {r361, r157}, {r336, r381}, {r349, r451}, {r254, r245}, {}, {r315, r417}, {r438, r472}, {r395, r299}, {r409}, {r448, r402}, {r461, r41}, {r215, r318}, {0x0, r201}, {r432, r304}, {0x0, r418}, {0x0, r334}, {r215, r233}, {r413, r406}, {r128, r248}, {r120, r384}, {r340, r427}, {r190}, {r80, r404}, {r397}, {r449, r380}, {r352}, {r14, r360}, {r43, r212}, {r302, r7}, {r43, r146}, {r135, r378}, {r168, r389}, {r130, r148}, {r61}, {r367, r142}, {r462, r357}, {0x0, r369}, {r250, r363}, {r178, r391}, {r314, r430}, {r313, r439}, {r348, r466}, {r377, r46}, {0x0, r162}, {}, {r377}, {r77, r203}, {0x0, r137}, {r123, r153}, {r342, r32}, {r398, r428}, {r446}, {0x0, r238}, {r483, r477}, {r338, r25}, {r488, r229}, {r429, r301}, {r24, r372}, {0x0, r324}, {r190, r30}, {0x0, r329}, {r55, r310}, {r242, r463}], 0x2, "c618147ed5ecf1"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000546c0)={0x0, [{0x0, r157}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r491}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r291}, {r285}, {}, {}, {}, {}, {}, {}, {}, {0x0, r248}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r390}], 0x0, "e72c184cca3d07"}) r492 = memfd_create(&(0x7f0000000900)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x84\xcdN\xf7\xf6\b~\xed_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xdcLF\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8o8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd930x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 1) [ 247.080438][ C0] sd 0:0:1:0: tag#1295 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 247.090394][ C0] sd 0:0:1:0: tag#1295 CDB: opcode=0xe5 (vendor) [ 247.096841][ C0] sd 0:0:1:0: tag#1295 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 247.105873][ C0] sd 0:0:1:0: tag#1295 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 247.115093][ C0] sd 0:0:1:0: tag#1295 CDB[20]: ba [ 247.115436][ T6198] FAULT_INJECTION: forcing a failure. 06:45:37 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 1) [ 247.115436][ T6198] name failslab, interval 1, probability 0, space 0, times 1 [ 247.132870][ T6198] CPU: 1 PID: 6198 Comm: syz-executor.4 Not tainted 5.15.0-rc5-syzkaller #0 [ 247.141557][ T6198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.151599][ T6198] Call Trace: [ 247.154881][ T6198] dump_stack_lvl+0xd6/0x122 [ 247.159459][ T6198] dump_stack+0x11/0x1b [ 247.163604][ T6198] should_fail+0x23c/0x250 [ 247.168004][ T6198] __should_failslab+0x81/0x90 [ 247.172821][ T6198] should_failslab+0x5/0x20 [ 247.177311][ T6198] kmem_cache_alloc_bulk+0x40/0x340 [ 247.182538][ T6198] io_submit_sqes+0x548/0xde0 [ 247.187211][ T6198] ? __fget_light+0x21b/0x260 [ 247.191961][ T6198] __se_sys_io_uring_enter+0x20d/0xb30 [ 247.197410][ T6198] ? __fget_light+0x21b/0x260 [ 247.202071][ T6198] ? fput+0x2d/0x130 [ 247.205958][ T6198] __x64_sys_io_uring_enter+0x74/0x80 [ 247.211317][ T6198] do_syscall_64+0x44/0xa0 [ 247.215734][ T6198] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 247.221658][ T6198] RIP: 0033:0x7f2996f6da39 [ 247.226084][ T6198] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 247.245703][ T6198] RSP: 002b:00007f2994ce4188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 247.254115][ T6198] RAX: ffffffffffffffda RBX: 00007f2997070f60 RCX: 00007f2996f6da39 [ 247.262154][ T6198] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 247.270104][ T6198] RBP: 00007f2994ce41d0 R08: 0000000000000000 R09: 0000000000000000 06:45:37 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 2) [ 247.278072][ T6198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.286661][ T6198] R13: 00007ffc7570ee9f R14: 00007f2994ce4300 R15: 0000000000022000 [ 247.307406][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 247.313117][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 247.321061][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 247.406740][ T6201] FAULT_INJECTION: forcing a failure. [ 247.406740][ T6201] name failslab, interval 1, probability 0, space 0, times 0 [ 247.419628][ T6201] CPU: 1 PID: 6201 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 247.428319][ T6201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.438365][ T6201] Call Trace: [ 247.441697][ T6201] dump_stack_lvl+0xd6/0x122 [ 247.446327][ T6201] dump_stack+0x11/0x1b [ 247.450460][ T6201] should_fail+0x23c/0x250 [ 247.455006][ T6201] __should_failslab+0x81/0x90 [ 247.459749][ T6201] should_failslab+0x5/0x20 [ 247.464258][ T6201] kmem_cache_alloc_bulk+0x40/0x340 [ 247.469437][ T6201] io_submit_sqes+0x548/0xde0 [ 247.474107][ T6201] ? __fget_light+0x21b/0x260 [ 247.478788][ T6201] __se_sys_io_uring_enter+0x20d/0xb30 [ 247.484267][ T6201] ? __fget_light+0x21b/0x260 [ 247.489070][ T6201] ? fput+0x2d/0x130 [ 247.492956][ T6201] __x64_sys_io_uring_enter+0x74/0x80 [ 247.498307][ T6201] do_syscall_64+0x44/0xa0 [ 247.502899][ T6201] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 247.508791][ T6201] RIP: 0033:0x7f60c072aa39 [ 247.513241][ T6201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 247.532872][ T6201] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 247.541268][ T6201] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 247.549221][ T6201] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 06:45:37 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 2) [ 247.557203][ T6201] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 247.565152][ T6201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.573139][ T6201] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 247.599847][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 247.605476][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 247.613409][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 247.674573][ T6204] FAULT_INJECTION: forcing a failure. [ 247.674573][ T6204] name failslab, interval 1, probability 0, space 0, times 0 [ 247.687276][ T6204] CPU: 0 PID: 6204 Comm: syz-executor.4 Not tainted 5.15.0-rc5-syzkaller #0 [ 247.695944][ T6204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.705997][ T6204] Call Trace: [ 247.709272][ T6204] dump_stack_lvl+0xd6/0x122 [ 247.711577][ T6210] FAULT_INJECTION: forcing a failure. [ 247.711577][ T6210] name failslab, interval 1, probability 0, space 0, times 0 [ 247.713864][ T6204] dump_stack+0x11/0x1b [ 247.730572][ T6204] should_fail+0x23c/0x250 [ 247.734976][ T6204] __should_failslab+0x81/0x90 [ 247.739749][ T6204] should_failslab+0x5/0x20 [ 247.744585][ T6204] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 247.750288][ T6204] ? create_io_worker+0x66/0x2f0 [ 247.755213][ T6204] create_io_worker+0x66/0x2f0 [ 247.759961][ T6204] io_wqe_enqueue+0x692/0x7f0 [ 247.764634][ T6204] ? io_prep_async_work+0x300/0x320 [ 247.769819][ T6204] io_wq_enqueue+0x31/0x40 [ 247.774221][ T6204] io_queue_async_work+0x13a/0x320 [ 247.779492][ T6204] __io_queue_sqe+0x422/0x460 [ 247.784157][ T6204] io_submit_sqe+0x88b/0x3eb0 [ 247.788851][ T6204] ? kmem_cache_alloc_bulk+0x289/0x340 [ 247.794307][ T6204] io_submit_sqes+0x505/0xde0 [ 247.799028][ T6204] __se_sys_io_uring_enter+0x20d/0xb30 [ 247.804594][ T6204] ? __fget_light+0x21b/0x260 [ 247.809320][ T6204] ? fput+0x2d/0x130 [ 247.813199][ T6204] __x64_sys_io_uring_enter+0x74/0x80 [ 247.818556][ T6204] do_syscall_64+0x44/0xa0 [ 247.823004][ T6204] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 247.828883][ T6204] RIP: 0033:0x7f2996f6da39 [ 247.833277][ T6204] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 247.852874][ T6204] RSP: 002b:00007f2994ce4188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 247.861360][ T6204] RAX: ffffffffffffffda RBX: 00007f2997070f60 RCX: 00007f2996f6da39 06:45:37 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 247.869310][ T6204] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 247.877262][ T6204] RBP: 00007f2994ce41d0 R08: 0000000000000000 R09: 0000000000000000 [ 247.885387][ T6204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.893338][ T6204] R13: 00007ffc7570ee9f R14: 00007f2994ce4300 R15: 0000000000022000 [ 247.901296][ T6210] CPU: 1 PID: 6210 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 247.909970][ T6210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.920132][ T6210] Call Trace: [ 247.923488][ T6210] dump_stack_lvl+0xd6/0x122 [ 247.928086][ T6210] dump_stack+0x11/0x1b [ 247.932239][ T6210] should_fail+0x23c/0x250 [ 247.936654][ T6210] __should_failslab+0x81/0x90 [ 247.941403][ T6210] should_failslab+0x5/0x20 [ 247.945888][ T6210] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 247.951594][ T6210] ? create_io_worker+0x66/0x2f0 [ 247.956516][ T6210] create_io_worker+0x66/0x2f0 [ 247.961264][ T6210] io_wqe_enqueue+0x692/0x7f0 [ 247.965947][ T6210] ? io_prep_async_work+0x300/0x320 [ 247.971137][ T6210] io_wq_enqueue+0x31/0x40 [ 247.975545][ T6210] io_queue_async_work+0x13a/0x320 [ 247.980718][ T6210] __io_queue_sqe+0x422/0x460 [ 247.985422][ T6210] io_submit_sqe+0x88b/0x3eb0 [ 247.990100][ T6210] ? kmem_cache_alloc_bulk+0x289/0x340 [ 247.995567][ T6210] io_submit_sqes+0x505/0xde0 [ 248.000281][ T6210] __se_sys_io_uring_enter+0x20d/0xb30 [ 248.005738][ T6210] ? __fget_light+0x21b/0x260 [ 248.010435][ T6210] ? fput+0x2d/0x130 [ 248.014318][ T6210] __x64_sys_io_uring_enter+0x74/0x80 [ 248.019759][ T6210] do_syscall_64+0x44/0xa0 [ 248.024161][ T6210] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 248.030046][ T6210] RIP: 0033:0x7f60c072aa39 [ 248.034529][ T6210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 248.054200][ T6210] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 248.062597][ T6210] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 248.070558][ T6210] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 248.078518][ T6210] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 248.086471][ T6210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 248.094419][ T6210] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 248.119953][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 248.125505][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 248.133709][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:39 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:39 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:39 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 3) 06:45:39 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:39 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 3) 06:45:39 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:39 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:39 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 250.112984][ T6221] FAULT_INJECTION: forcing a failure. [ 250.112984][ T6221] name failslab, interval 1, probability 0, space 0, times 0 [ 250.125644][ T6221] CPU: 0 PID: 6221 Comm: syz-executor.4 Not tainted 5.15.0-rc5-syzkaller #0 [ 250.132311][ T6218] FAULT_INJECTION: forcing a failure. [ 250.132311][ T6218] name failslab, interval 1, probability 0, space 0, times 0 [ 250.134310][ T6221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 250.134366][ T6221] Call Trace: [ 250.134373][ T6221] dump_stack_lvl+0xd6/0x122 [ 250.134399][ T6221] dump_stack+0x11/0x1b [ 250.134414][ T6221] should_fail+0x23c/0x250 [ 250.134430][ T6221] __should_failslab+0x81/0x90 [ 250.134446][ T6221] should_failslab+0x5/0x20 [ 250.182730][ T6221] kmem_cache_alloc_node+0x61/0x2c0 [ 250.188039][ T6221] ? dup_task_struct+0x63/0x680 [ 250.192925][ T6221] dup_task_struct+0x63/0x680 [ 250.197590][ T6221] ? __schedule+0x435/0x680 [ 250.202134][ T6221] ? __dequeue_signal+0x92/0x380 [ 250.207057][ T6221] copy_process+0x413/0x2fa0 [ 250.211627][ T6221] ? get_signal+0x1523/0x15d0 [ 250.216357][ T6221] ? create_io_worker+0x2f0/0x2f0 [ 250.221430][ T6221] create_io_thread+0x95/0xc0 [ 250.226091][ T6221] ? create_io_worker+0x2f0/0x2f0 [ 250.231492][ T6221] create_worker_cont+0x5a/0x340 [ 250.236414][ T6221] ? arch_do_signal_or_restart+0x8c/0x280 [ 250.242159][ T6221] task_work_run+0xae/0x130 [ 250.246645][ T6221] exit_to_user_mode_prepare+0xf8/0x190 [ 250.252227][ T6221] syscall_exit_to_user_mode+0x20/0x40 [ 250.257669][ T6221] do_syscall_64+0x50/0xa0 [ 250.262158][ T6221] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 250.268117][ T6221] RIP: 0033:0x7f2996f6da39 [ 250.272512][ T6221] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 250.292161][ T6221] RSP: 002b:00007f2994ce4188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 250.300648][ T6221] RAX: 0000000000000001 RBX: 00007f2997070f60 RCX: 00007f2996f6da39 [ 250.308610][ T6221] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 250.316562][ T6221] RBP: 00007f2994ce41d0 R08: 0000000000000000 R09: 0000000000000000 [ 250.324684][ T6221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.332682][ T6221] R13: 00007ffc7570ee9f R14: 00007f2994ce4300 R15: 0000000000022000 [ 250.340642][ T6218] CPU: 1 PID: 6218 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 250.349763][ T6218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 250.359846][ T6218] Call Trace: 06:45:39 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 250.363110][ T6218] dump_stack_lvl+0xd6/0x122 [ 250.367680][ T6218] dump_stack+0x11/0x1b [ 250.371885][ T6218] should_fail+0x23c/0x250 [ 250.376310][ T6218] __should_failslab+0x81/0x90 [ 250.381051][ T6218] should_failslab+0x5/0x20 [ 250.385617][ T6218] kmem_cache_alloc_bulk+0x40/0x340 [ 250.390795][ T6218] io_submit_sqes+0x548/0xde0 [ 250.395486][ T6218] __se_sys_io_uring_enter+0x20d/0xb30 [ 250.400925][ T6218] ? __fget_light+0x21b/0x260 [ 250.405636][ T6218] ? fput+0x2d/0x130 06:45:40 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 4) 06:45:40 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 250.409567][ T6218] __x64_sys_io_uring_enter+0x74/0x80 [ 250.414970][ T6218] do_syscall_64+0x44/0xa0 [ 250.419487][ T6218] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 250.425440][ T6218] RIP: 0033:0x7f60c072aa39 [ 250.429842][ T6218] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 250.449455][ T6218] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:45:40 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:40 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 4) [ 250.457865][ T6218] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 250.465883][ T6218] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 250.473833][ T6218] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 250.481885][ T6218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.489872][ T6218] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 250.514698][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 250.520249][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 250.528524][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 250.651481][ T6245] FAULT_INJECTION: forcing a failure. [ 250.651481][ T6245] name failslab, interval 1, probability 0, space 0, times 0 [ 250.659820][ T6240] FAULT_INJECTION: forcing a failure. [ 250.659820][ T6240] name failslab, interval 1, probability 0, space 0, times 0 [ 250.664136][ T6245] CPU: 1 PID: 6245 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 250.685348][ T6245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 250.695426][ T6245] Call Trace: [ 250.698689][ T6245] dump_stack_lvl+0xd6/0x122 [ 250.703390][ T6245] dump_stack+0x11/0x1b [ 250.707525][ T6245] should_fail+0x23c/0x250 [ 250.711922][ T6245] ? alloc_pid+0x71/0x760 [ 250.716232][ T6245] __should_failslab+0x81/0x90 [ 250.720979][ T6245] should_failslab+0x5/0x20 [ 250.725464][ T6245] kmem_cache_alloc+0x4f/0x300 [ 250.730234][ T6245] ? avc_has_perm+0xd5/0x160 [ 250.734811][ T6245] alloc_pid+0x71/0x760 [ 250.738974][ T6245] ? create_io_worker+0x2f0/0x2f0 [ 250.744021][ T6245] ? copy_thread+0x128/0x200 [ 250.748596][ T6245] copy_process+0x171c/0x2fa0 [ 250.753270][ T6245] ? create_io_worker+0x2f0/0x2f0 [ 250.758325][ T6245] create_io_thread+0x95/0xc0 [ 250.762986][ T6245] ? create_io_worker+0x2f0/0x2f0 [ 250.768080][ T6245] create_io_worker+0x1ac/0x2f0 [ 250.772936][ T6245] io_wqe_enqueue+0x692/0x7f0 [ 250.777632][ T6245] ? io_prep_async_work+0x300/0x320 [ 250.782911][ T6245] io_wq_enqueue+0x31/0x40 [ 250.787349][ T6245] io_queue_async_work+0x13a/0x320 [ 250.792513][ T6245] __io_queue_sqe+0x422/0x460 [ 250.797295][ T6245] io_submit_sqe+0x88b/0x3eb0 [ 250.802040][ T6245] ? kmem_cache_alloc_bulk+0x289/0x340 [ 250.807481][ T6245] io_submit_sqes+0x505/0xde0 [ 250.812152][ T6245] __se_sys_io_uring_enter+0x20d/0xb30 [ 250.817612][ T6245] ? fpregs_restore_userregs+0x10c/0x1c0 [ 250.823334][ T6245] __x64_sys_io_uring_enter+0x74/0x80 [ 250.828705][ T6245] do_syscall_64+0x44/0xa0 [ 250.833135][ T6245] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 250.839022][ T6245] RIP: 0033:0x7f60c072aa39 [ 250.843512][ T6245] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 250.863172][ T6245] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 250.871564][ T6245] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 250.879522][ T6245] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 250.887478][ T6245] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 250.895434][ T6245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.903385][ T6245] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 250.911429][ T6240] CPU: 0 PID: 6240 Comm: syz-executor.4 Not tainted 5.15.0-rc5-syzkaller #0 [ 250.920171][ T6240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 250.930421][ T6240] Call Trace: [ 250.933692][ T6240] dump_stack_lvl+0xd6/0x122 [ 250.938282][ T6240] dump_stack+0x11/0x1b [ 250.942501][ T6240] should_fail+0x23c/0x250 [ 250.946912][ T6240] __should_failslab+0x81/0x90 [ 250.951787][ T6240] should_failslab+0x5/0x20 [ 250.952664][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 250.956336][ T6240] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 250.956359][ T6240] ? __get_vm_area_node+0x11b/0x260 [ 250.956379][ T6240] __get_vm_area_node+0x11b/0x260 [ 250.961926][ T379] loop2: p2 size 1073741824 extends beyond EOD, [ 250.967424][ T6240] __vmalloc_node_range+0xb2/0x600 [ 250.967446][ T6240] ? copy_process+0x413/0x2fa0 [ 250.967463][ T6240] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 250.972638][ T379] truncated 06:45:40 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:40 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:40 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 5) [ 250.984078][ T379] loop2: p5 size 1073741824 extends beyond EOD, [ 250.989132][ T6240] dup_task_struct+0x496/0x680 [ 250.989156][ T6240] ? copy_process+0x413/0x2fa0 [ 250.993910][ T379] truncated [ 251.021836][ T6240] ? __schedule+0x435/0x680 [ 251.026426][ T6240] ? __dequeue_signal+0x92/0x380 [ 251.031404][ T6240] copy_process+0x413/0x2fa0 [ 251.035994][ T6240] ? get_signal+0x1523/0x15d0 [ 251.040697][ T6240] ? create_io_worker+0x2f0/0x2f0 [ 251.045779][ T6240] create_io_thread+0x95/0xc0 [ 251.050624][ T6240] ? create_io_worker+0x2f0/0x2f0 [ 251.055906][ T6240] create_worker_cont+0x5a/0x340 [ 251.060847][ T6240] ? arch_do_signal_or_restart+0x8c/0x280 [ 251.066584][ T6240] task_work_run+0xae/0x130 [ 251.071135][ T6240] exit_to_user_mode_prepare+0xf8/0x190 [ 251.076763][ T6240] syscall_exit_to_user_mode+0x20/0x40 [ 251.082257][ T6240] do_syscall_64+0x50/0xa0 [ 251.086654][ T6240] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 251.092630][ T6240] RIP: 0033:0x7f2996f6da39 [ 251.097023][ T6240] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 251.116884][ T6240] RSP: 002b:00007f2994ce4188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 251.125509][ T6240] RAX: 0000000000000001 RBX: 00007f2997070f60 RCX: 00007f2996f6da39 [ 251.133467][ T6240] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 251.141446][ T6240] RBP: 00007f2994ce41d0 R08: 0000000000000000 R09: 0000000000000000 [ 251.149415][ T6240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 251.157581][ T6240] R13: 00007ffc7570ee9f R14: 00007f2994ce4300 R15: 0000000000022000 [ 251.165602][ T6240] syz-executor.4: vmalloc error: size 16384, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0 [ 251.181498][ T6240] CPU: 0 PID: 6240 Comm: syz-executor.4 Not tainted 5.15.0-rc5-syzkaller #0 [ 251.190434][ T6240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 251.191490][ T6254] FAULT_INJECTION: forcing a failure. [ 251.191490][ T6254] name failslab, interval 1, probability 0, space 0, times 0 [ 251.200582][ T6240] Call Trace: [ 251.200591][ T6240] dump_stack_lvl+0xd6/0x122 [ 251.221000][ T6240] dump_stack+0x11/0x1b [ 251.225164][ T6240] warn_alloc+0x132/0x190 [ 251.229485][ T6240] __vmalloc_node_range+0x207/0x600 [ 251.234675][ T6240] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 251.240136][ T6240] dup_task_struct+0x496/0x680 [ 251.244905][ T6240] ? copy_process+0x413/0x2fa0 [ 251.249713][ T6240] ? __schedule+0x435/0x680 [ 251.254224][ T6240] ? __dequeue_signal+0x92/0x380 [ 251.259154][ T6240] copy_process+0x413/0x2fa0 [ 251.263756][ T6240] ? get_signal+0x1523/0x15d0 [ 251.268433][ T6240] ? create_io_worker+0x2f0/0x2f0 [ 251.273531][ T6240] create_io_thread+0x95/0xc0 [ 251.278219][ T6240] ? create_io_worker+0x2f0/0x2f0 [ 251.283346][ T6240] create_worker_cont+0x5a/0x340 [ 251.288283][ T6240] ? arch_do_signal_or_restart+0x8c/0x280 [ 251.294009][ T6240] task_work_run+0xae/0x130 [ 251.298550][ T6240] exit_to_user_mode_prepare+0xf8/0x190 [ 251.304251][ T6240] syscall_exit_to_user_mode+0x20/0x40 [ 251.309708][ T6240] do_syscall_64+0x50/0xa0 [ 251.314116][ T6240] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 251.320058][ T6240] RIP: 0033:0x7f2996f6da39 [ 251.324470][ T6240] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 251.344599][ T6240] RSP: 002b:00007f2994ce4188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 251.353097][ T6240] RAX: 0000000000000001 RBX: 00007f2997070f60 RCX: 00007f2996f6da39 [ 251.361100][ T6240] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 251.369124][ T6240] RBP: 00007f2994ce41d0 R08: 0000000000000000 R09: 0000000000000000 [ 251.377341][ T6240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 251.385440][ T6240] R13: 00007ffc7570ee9f R14: 00007f2994ce4300 R15: 0000000000022000 [ 251.393400][ T6254] CPU: 1 PID: 6254 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 251.393441][ T6240] Mem-Info: [ 251.393446][ T6240] active_anon:333 inactive_anon:72762 isolated_anon:0 [ 251.393446][ T6240] active_file:3309 inactive_file:55019 isolated_file:0 [ 251.393446][ T6240] unevictable:0 dirty:137 writeback:0 [ 251.393446][ T6240] slab_reclaimable:3833 slab_unreclaimable:5051 [ 251.393446][ T6240] mapped:58180 shmem:379 pagetables:1215 bounce:0 [ 251.393446][ T6240] kernel_misc_reclaimable:0 [ 251.393446][ T6240] free:1824167 free_pcp:2445 free_cma:0 [ 251.402280][ T6254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 251.402291][ T6254] Call Trace: [ 251.402297][ T6254] dump_stack_lvl+0xd6/0x122 [ 251.405386][ T6240] Node 0 active_anon:1332kB inactive_anon:291048kB active_file:13236kB inactive_file:220076kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:232720kB dirty:548kB writeback:0kB shmem:1516kB writeback_tmp:0kB kernel_stack:1984kB pagetables:4860kB all_unreclaimable? no [ 251.446786][ T6254] dump_stack+0x11/0x1b [ 251.446806][ T6254] should_fail+0x23c/0x250 [ 251.456865][ T6240] Node 0 [ 251.460210][ T6254] __should_failslab+0x81/0x90 [ 251.464800][ T6240] DMA free:15360kB min:20kB low:32kB high:44kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 251.491330][ T6254] should_failslab+0x5/0x20 [ 251.491350][ T6254] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 251.495486][ T6240] lowmem_reserve[]: 0 [ 251.499871][ T6254] ? __kmalloc_node+0x30/0x40 [ 251.499890][ T6254] __kmalloc_node+0x30/0x40 [ 251.502805][ T6240] 2942 [ 251.507530][ T6254] memcg_alloc_page_obj_cgroups+0x46/0x90 [ 251.532821][ T6240] 7920 [ 251.537379][ T6254] kmem_getpages+0x40/0xd0 [ 251.543095][ T6240] 7920 [ 251.547140][ T6254] cache_grow_begin+0x4c/0x1a0 [ 251.552011][ T6240] [ 251.556477][ T6254] cache_alloc_refill+0x326/0x3d0 [ 251.559238][ T6240] Node 0 DMA32 free:3014332kB min:4224kB low:7236kB high:10248kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:3017192kB mlocked:0kB bounce:0kB free_pcp:2860kB local_pcp:56kB free_cma:0kB [ 251.564945][ T6254] ? obj_cgroup_charge+0xd3/0x160 [ 251.567709][ T6240] lowmem_reserve[]: [ 251.572087][ T6254] kmem_cache_alloc_bulk+0x1ec/0x340 [ 251.574837][ T6240] 0 0 [ 251.579762][ T6254] io_submit_sqes+0x548/0xde0 [ 251.582084][ T6240] 4978 [ 251.587081][ T6254] __se_sys_io_uring_enter+0x20d/0xb30 [ 251.614585][ T6240] 4978 [ 251.619566][ T6254] ? __fget_light+0x21b/0x260 [ 251.623467][ T6240] [ 251.628712][ T6254] ? fput+0x2d/0x130 [ 251.631396][ T6240] Node 0 [ 251.636058][ T6254] __x64_sys_io_uring_enter+0x74/0x80 [ 251.638912][ T6240] Normal free:4266976kB min:7152kB low:12248kB high:17344kB reserved_highatomic:0KB active_anon:1332kB inactive_anon:291048kB active_file:13236kB inactive_file:220076kB unevictable:0kB writepending:548kB present:5242880kB managed:5098288kB mlocked:0kB bounce:0kB free_pcp:6920kB local_pcp:3784kB free_cma:0kB [ 251.644352][ T6254] do_syscall_64+0x44/0xa0 [ 251.647113][ T6240] lowmem_reserve[]: [ 251.651762][ T6254] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 251.654074][ T6240] 0 0 [ 251.657943][ T6254] RIP: 0033:0x7f60c072aa39 [ 251.657960][ T6254] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 251.660942][ T6240] 0 [ 251.666275][ T6254] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 251.666358][ T6254] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 251.695672][ T6240] 0 [ 251.700070][ T6254] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 251.700087][ T6254] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 251.700098][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 251.700108][ T6254] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 251.703892][ T6240] [ 251.703898][ T6240] Node 0 [ 251.777118][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 251.781840][ T6240] DMA: 0*4kB [ 251.790427][ T379] loop2: p2 size 1073741824 extends beyond EOD, [ 251.792155][ T6240] 0*8kB 0*16kB 0*32kB 0*64kB [ 251.795099][ T379] truncated [ 251.800381][ T6240] 0*128kB 0*256kB 0*512kB [ 251.804970][ T379] loop2: p5 size 1073741824 extends beyond EOD, [ 251.809969][ T6240] 1*1024kB (U) 1*2048kB [ 251.814669][ T379] truncated [ 251.817759][ T6240] (M) 3*4096kB (M) = 15360kB [ 251.840745][ T6240] Node 0 DMA32: 3*4kB (M) 2*8kB (M) 4*16kB (M) 5*32kB (M) 5*64kB (M) 3*128kB (M) 3*256kB (M) 4*512kB (M) 2*1024kB (M) 1*2048kB (M) 734*4096kB (M) = 3014332kB [ 251.856821][ T6240] Node 0 Normal: 290*4kB (UME) 140*8kB (UME) 84*16kB (UME) 92*32kB (UME) 57*64kB (UM) 50*128kB (UME) 16*256kB (M) 11*512kB (ME) 5*1024kB (UM) 4*2048kB (UM) 1032*4096kB (M) = 4266728kB [ 251.875029][ T6240] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 251.884379][ T6240] 12718 total pagecache pages [ 251.889059][ T6240] 0 pages in swap cache [ 251.893208][ T6240] Swap cache stats: add 0, delete 0, find 0/0 [ 251.899457][ T6240] Free swap = 0kB [ 251.903247][ T6240] Total swap = 0kB 06:45:41 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 251.907239][ T6240] 2097051 pages RAM [ 251.911028][ T6240] 0 pages HighMem/MovableOnly [ 251.915722][ T6240] 64341 pages reserved 06:45:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:42 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:42 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 6) 06:45:42 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:42 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:42 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:43 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:43 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:43 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 253.275050][ T6271] FAULT_INJECTION: forcing a failure. [ 253.275050][ T6271] name failslab, interval 1, probability 0, space 0, times 0 [ 253.287920][ T6271] CPU: 0 PID: 6271 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 253.296597][ T6271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 253.306648][ T6271] Call Trace: [ 253.309927][ T6271] dump_stack_lvl+0xd6/0x122 [ 253.314524][ T6271] dump_stack+0x11/0x1b [ 253.318675][ T6271] should_fail+0x23c/0x250 [ 253.323081][ T6271] __should_failslab+0x81/0x90 [ 253.327824][ T6271] should_failslab+0x5/0x20 [ 253.332331][ T6271] kmem_cache_alloc_bulk+0x40/0x340 [ 253.337667][ T6271] io_submit_sqes+0x548/0xde0 [ 253.342427][ T6271] __se_sys_io_uring_enter+0x20d/0xb30 [ 253.347931][ T6271] ? __fget_light+0x21b/0x260 [ 253.352593][ T6271] ? fput+0x2d/0x130 [ 253.356525][ T6271] __x64_sys_io_uring_enter+0x74/0x80 [ 253.361877][ T6271] do_syscall_64+0x44/0xa0 [ 253.366330][ T6271] entry_SYSCALL_64_after_hwframe+0x44/0xae 06:45:43 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 253.372236][ T6271] RIP: 0033:0x7f60c072aa39 [ 253.376631][ T6271] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 253.396224][ T6271] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 253.404735][ T6271] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 253.412700][ T6271] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 06:45:43 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 7) [ 253.420652][ T6271] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 253.428612][ T6271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.436657][ T6271] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 253.463815][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 06:45:43 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x2, 0x0, 0x0, 0x0) [ 253.469647][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 253.477692][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 253.552681][ T6293] FAULT_INJECTION: forcing a failure. [ 253.552681][ T6293] name failslab, interval 1, probability 0, space 0, times 0 [ 253.565388][ T6293] CPU: 1 PID: 6293 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 253.574161][ T6293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 253.584203][ T6293] Call Trace: [ 253.587481][ T6293] dump_stack_lvl+0xd6/0x122 [ 253.592057][ T6293] dump_stack+0x11/0x1b [ 253.596275][ T6293] should_fail+0x23c/0x250 [ 253.600683][ T6293] __should_failslab+0x81/0x90 [ 253.605437][ T6293] should_failslab+0x5/0x20 [ 253.610149][ T6293] kmem_cache_alloc_bulk+0x40/0x340 [ 253.615337][ T6293] io_submit_sqes+0x548/0xde0 [ 253.620005][ T6293] __se_sys_io_uring_enter+0x20d/0xb30 [ 253.625457][ T6293] ? __fget_light+0x21b/0x260 [ 253.630125][ T6293] ? fput+0x2d/0x130 [ 253.634008][ T6293] __x64_sys_io_uring_enter+0x74/0x80 [ 253.639434][ T6293] do_syscall_64+0x44/0xa0 [ 253.643854][ T6293] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 253.649879][ T6293] RIP: 0033:0x7f60c072aa39 [ 253.654284][ T6293] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 253.674059][ T6293] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 253.682458][ T6293] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 253.690421][ T6293] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 253.698680][ T6293] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 253.706630][ T6293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.714580][ T6293] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 253.748119][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 253.753719][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 253.761576][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:46 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 8) 06:45:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x6, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) tee(0xffffffffffffffff, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:46 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 256.356231][ T6311] FAULT_INJECTION: forcing a failure. [ 256.356231][ T6311] name failslab, interval 1, probability 0, space 0, times 0 [ 256.368866][ T6311] CPU: 0 PID: 6311 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 256.377538][ T6311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 256.387573][ T6311] Call Trace: [ 256.390834][ T6311] dump_stack_lvl+0xd6/0x122 [ 256.395414][ T6311] dump_stack+0x11/0x1b [ 256.399556][ T6311] should_fail+0x23c/0x250 [ 256.404033][ T6311] __should_failslab+0x81/0x90 [ 256.408869][ T6311] should_failslab+0x5/0x20 [ 256.413440][ T6311] kmem_cache_alloc_bulk+0x40/0x340 [ 256.418639][ T6311] io_submit_sqes+0x548/0xde0 [ 256.423324][ T6311] __se_sys_io_uring_enter+0x20d/0xb30 [ 256.428791][ T6311] ? __fget_light+0x21b/0x260 [ 256.433489][ T6311] ? fput+0x2d/0x130 [ 256.437403][ T6311] __x64_sys_io_uring_enter+0x74/0x80 [ 256.442752][ T6311] do_syscall_64+0x44/0xa0 [ 256.447175][ T6311] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 256.453056][ T6311] RIP: 0033:0x7f60c072aa39 [ 256.457447][ T6311] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 256.477042][ T6311] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 256.485431][ T6311] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 256.493505][ T6311] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 06:45:46 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 9) [ 256.501543][ T6311] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 256.509500][ T6311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 256.517452][ T6311] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 256.543139][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 256.548836][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 256.557111][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 256.651198][ T6347] FAULT_INJECTION: forcing a failure. [ 256.651198][ T6347] name failslab, interval 1, probability 0, space 0, times 0 [ 256.663883][ T6347] CPU: 0 PID: 6347 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 256.672645][ T6347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 256.682686][ T6347] Call Trace: [ 256.685952][ T6347] dump_stack_lvl+0xd6/0x122 [ 256.690531][ T6347] dump_stack+0x11/0x1b [ 256.694707][ T6347] should_fail+0x23c/0x250 [ 256.699111][ T6347] __should_failslab+0x81/0x90 [ 256.703872][ T6347] should_failslab+0x5/0x20 [ 256.708483][ T6347] kmem_cache_alloc_bulk+0x40/0x340 [ 256.713676][ T6347] io_submit_sqes+0x548/0xde0 [ 256.718378][ T6347] __se_sys_io_uring_enter+0x20d/0xb30 [ 256.723815][ T6347] ? __fget_light+0x21b/0x260 [ 256.728552][ T6347] ? fput+0x2d/0x130 [ 256.732513][ T6347] __x64_sys_io_uring_enter+0x74/0x80 [ 256.737984][ T6347] do_syscall_64+0x44/0xa0 [ 256.742408][ T6347] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 256.748356][ T6347] RIP: 0033:0x7f60c072aa39 [ 256.752756][ T6347] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 256.772375][ T6347] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 256.780786][ T6347] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 256.788736][ T6347] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 256.796699][ T6347] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 256.804661][ T6347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 256.812682][ T6347] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 256.843035][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 256.848571][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 256.856683][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:49 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x7, 0x0, 0x0, 0x0) 06:45:49 executing program 3: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 10) 06:45:49 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 3: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, 0x0, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 259.422076][ T6356] FAULT_INJECTION: forcing a failure. [ 259.422076][ T6356] name failslab, interval 1, probability 0, space 0, times 0 [ 259.434703][ T6356] CPU: 1 PID: 6356 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 259.443450][ T6356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 259.453486][ T6356] Call Trace: [ 259.456750][ T6356] dump_stack_lvl+0xd6/0x122 [ 259.461391][ T6356] dump_stack+0x11/0x1b [ 259.465545][ T6356] should_fail+0x23c/0x250 [ 259.469939][ T6356] __should_failslab+0x81/0x90 [ 259.474714][ T6356] should_failslab+0x5/0x20 [ 259.479197][ T6356] kmem_cache_alloc_bulk+0x40/0x340 [ 259.484405][ T6356] io_submit_sqes+0x548/0xde0 [ 259.489101][ T6356] __se_sys_io_uring_enter+0x20d/0xb30 [ 259.494600][ T6356] ? __fget_light+0x21b/0x260 [ 259.499259][ T6356] ? fput+0x2d/0x130 [ 259.503176][ T6356] __x64_sys_io_uring_enter+0x74/0x80 [ 259.508535][ T6356] do_syscall_64+0x44/0xa0 [ 259.512946][ T6356] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 259.518899][ T6356] RIP: 0033:0x7f60c072aa39 [ 259.523330][ T6356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 259.543095][ T6356] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 259.551487][ T6356] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 259.559438][ T6356] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 259.567389][ T6356] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 259.575347][ T6356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 259.583477][ T6356] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 259.609088][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 259.614692][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 259.622797][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:49 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0xf, 0x0, 0x0, 0x0) 06:45:49 executing program 3: syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 11) 06:45:49 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:49 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 260.038884][ T6387] FAULT_INJECTION: forcing a failure. [ 260.038884][ T6387] name failslab, interval 1, probability 0, space 0, times 0 [ 260.051499][ T6387] CPU: 1 PID: 6387 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 260.060194][ T6387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 260.070259][ T6387] Call Trace: [ 260.073524][ T6387] dump_stack_lvl+0xd6/0x122 [ 260.078098][ T6387] dump_stack+0x11/0x1b [ 260.082234][ T6387] should_fail+0x23c/0x250 06:45:49 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:50 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 260.086635][ T6387] __should_failslab+0x81/0x90 [ 260.091419][ T6387] should_failslab+0x5/0x20 [ 260.095906][ T6387] kmem_cache_alloc_bulk+0x40/0x340 [ 260.101101][ T6387] io_submit_sqes+0x548/0xde0 [ 260.105826][ T6387] __se_sys_io_uring_enter+0x20d/0xb30 [ 260.111283][ T6387] ? __fget_light+0x21b/0x260 [ 260.115966][ T6387] ? fput+0x2d/0x130 [ 260.119967][ T6387] __x64_sys_io_uring_enter+0x74/0x80 [ 260.125324][ T6387] do_syscall_64+0x44/0xa0 [ 260.129817][ T6387] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 260.135819][ T6387] RIP: 0033:0x7f60c072aa39 [ 260.140231][ T6387] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 260.159833][ T6387] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 260.168227][ T6387] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 260.176191][ T6387] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 06:45:50 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:45:50 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 12) [ 260.184163][ T6387] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 260.192145][ T6387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 260.200108][ T6387] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 260.238700][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 260.244185][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 260.252234][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:50 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 1) 06:45:50 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x600, 0x0, 0x0, 0x0) [ 260.397687][ T6416] FAULT_INJECTION: forcing a failure. [ 260.397687][ T6416] name failslab, interval 1, probability 0, space 0, times 0 [ 260.410386][ T6416] CPU: 1 PID: 6416 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 260.419047][ T6416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 260.429098][ T6416] Call Trace: [ 260.432386][ T6416] dump_stack_lvl+0xd6/0x122 [ 260.436971][ T6416] dump_stack+0x11/0x1b [ 260.441227][ T6416] should_fail+0x23c/0x250 [ 260.445652][ T6416] __should_failslab+0x81/0x90 [ 260.450415][ T6416] should_failslab+0x5/0x20 [ 260.454897][ T6416] kmem_cache_alloc_bulk+0x40/0x340 [ 260.460076][ T6416] io_submit_sqes+0x548/0xde0 [ 260.464735][ T6416] ? __fget_light+0x21b/0x260 [ 260.469391][ T6416] __se_sys_io_uring_enter+0x20d/0xb30 [ 260.474826][ T6416] ? __fget_light+0x21b/0x260 [ 260.479512][ T6416] ? fput+0x2d/0x130 [ 260.483390][ T6416] __x64_sys_io_uring_enter+0x74/0x80 [ 260.488886][ T6416] do_syscall_64+0x44/0xa0 [ 260.493292][ T6416] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 260.499194][ T6416] RIP: 0033:0x7fc02cad5a39 [ 260.503627][ T6416] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 260.523396][ T6416] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 260.531786][ T6416] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 260.539736][ T6416] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 260.547688][ T6416] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 260.555645][ T6416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.563670][ T6416] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 260.572160][ T6414] FAULT_INJECTION: forcing a failure. [ 260.572160][ T6414] name failslab, interval 1, probability 0, space 0, times 0 [ 260.584763][ T6414] CPU: 1 PID: 6414 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 260.587221][ T22] audit: type=1400 audit(1634539550.451:3220): avc: denied { remove_name } for pid=361 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 260.593412][ T6414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 260.593426][ T6414] Call Trace: [ 260.593433][ T6414] dump_stack_lvl+0xd6/0x122 06:45:50 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 2) [ 260.615975][ T22] audit: type=1400 audit(1634539550.451:3221): avc: denied { rename } for pid=361 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 260.625956][ T6414] dump_stack+0x11/0x1b [ 260.625980][ T6414] should_fail+0x23c/0x250 [ 260.664775][ T6414] __should_failslab+0x81/0x90 [ 260.669716][ T6414] should_failslab+0x5/0x20 [ 260.674229][ T6414] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 260.679970][ T6414] ? __kmalloc_node+0x30/0x40 [ 260.684656][ T6414] ? __get_vm_area_node+0x226/0x260 [ 260.690016][ T6414] __kmalloc_node+0x30/0x40 06:45:50 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x700, 0x0, 0x0, 0x0) 06:45:50 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 260.694681][ T6414] __vmalloc_node_range+0x231/0x600 [ 260.699948][ T6414] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 260.705428][ T6414] dup_task_struct+0x496/0x680 [ 260.710236][ T6414] ? copy_process+0x413/0x2fa0 [ 260.714992][ T6414] ? kvm_sched_clock_read+0xd/0x20 [ 260.720104][ T6414] ? sched_clock_cpu+0xe/0x180 [ 260.724862][ T6414] copy_process+0x413/0x2fa0 [ 260.729434][ T6414] ? io_issue_sqe+0x6172/0x67b0 [ 260.734296][ T6414] ? create_io_worker+0x2f0/0x2f0 [ 260.739357][ T6414] create_io_thread+0x95/0xc0 [ 260.744108][ T6414] ? create_io_worker+0x2f0/0x2f0 [ 260.749140][ T6414] create_io_worker+0x1ac/0x2f0 [ 260.753995][ T6414] io_wqe_enqueue+0x692/0x7f0 [ 260.758742][ T6414] ? io_prep_async_work+0x300/0x320 [ 260.764293][ T6414] io_wq_enqueue+0x31/0x40 [ 260.768737][ T6414] io_queue_async_work+0x13a/0x320 [ 260.770864][ T6427] FAULT_INJECTION: forcing a failure. [ 260.770864][ T6427] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 260.773845][ T6414] __io_queue_sqe+0x422/0x460 [ 260.791671][ T6414] io_submit_sqe+0x88b/0x3eb0 [ 260.796466][ T6414] ? kmem_cache_alloc_bulk+0x289/0x340 [ 260.801921][ T6414] io_submit_sqes+0x505/0xde0 [ 260.806723][ T6414] __se_sys_io_uring_enter+0x20d/0xb30 [ 260.812241][ T6414] ? __fget_light+0x21b/0x260 [ 260.816905][ T6414] ? fput+0x2d/0x130 [ 260.820915][ T6414] __x64_sys_io_uring_enter+0x74/0x80 [ 260.826455][ T6414] do_syscall_64+0x44/0xa0 [ 260.830863][ T6414] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 260.836838][ T6414] RIP: 0033:0x7f60c072aa39 [ 260.841239][ T6414] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 260.860827][ T6414] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 260.869393][ T6414] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 260.877384][ T6414] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 260.885333][ T6414] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 260.893283][ T6414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 260.901241][ T6414] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 260.909248][ T6427] CPU: 0 PID: 6427 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 260.917917][ T6427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 260.928021][ T6427] Call Trace: [ 260.931278][ T6427] dump_stack_lvl+0xd6/0x122 [ 260.935862][ T6427] dump_stack+0x11/0x1b [ 260.940110][ T6427] should_fail+0x23c/0x250 [ 260.944583][ T6427] __alloc_pages+0x102/0x320 [ 260.949162][ T6427] kmem_getpages+0x1a/0xd0 [ 260.953579][ T6427] cache_grow_begin+0x4c/0x1a0 [ 260.958408][ T6427] cache_alloc_refill+0x326/0x3d0 [ 260.963497][ T6427] ? obj_cgroup_charge+0xd3/0x160 [ 260.968576][ T6427] kmem_cache_alloc_bulk+0x1ec/0x340 [ 260.973839][ T6427] io_submit_sqes+0x548/0xde0 [ 260.978496][ T6427] ? __fget_light+0x21b/0x260 [ 260.983244][ T6427] __se_sys_io_uring_enter+0x20d/0xb30 [ 260.988702][ T6427] ? __fget_light+0x21b/0x260 [ 260.993389][ T6427] ? fput+0x2d/0x130 [ 260.997275][ T6427] __x64_sys_io_uring_enter+0x74/0x80 [ 261.002682][ T6427] do_syscall_64+0x44/0xa0 [ 261.007081][ T6427] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 261.012958][ T6427] RIP: 0033:0x7fc02cad5a39 [ 261.017356][ T6427] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 261.036964][ T6427] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:45:50 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:50 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:50 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 13) [ 261.045374][ T6427] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 261.053322][ T6427] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 261.061272][ T6427] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 261.069226][ T6427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 261.077180][ T6427] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:45:51 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 3) [ 261.113931][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 261.120085][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 261.131977][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 261.213124][ T6446] FAULT_INJECTION: forcing a failure. [ 261.213124][ T6446] name failslab, interval 1, probability 0, space 0, times 0 [ 261.225928][ T6446] CPU: 0 PID: 6446 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 261.234597][ T6446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 261.244819][ T6446] Call Trace: [ 261.248086][ T6446] dump_stack_lvl+0xd6/0x122 [ 261.252705][ T6446] dump_stack+0x11/0x1b [ 261.256890][ T6446] should_fail+0x23c/0x250 [ 261.261331][ T6446] __should_failslab+0x81/0x90 [ 261.266227][ T6446] should_failslab+0x5/0x20 [ 261.270805][ T6446] kmem_cache_alloc_node+0x61/0x2c0 [ 261.276020][ T6446] ? dup_task_struct+0x63/0x680 [ 261.281003][ T6446] dup_task_struct+0x63/0x680 [ 261.285720][ T6446] copy_process+0x413/0x2fa0 [ 261.290316][ T6446] ? io_issue_sqe+0x6172/0x67b0 [ 261.291868][ T6441] FAULT_INJECTION: forcing a failure. [ 261.291868][ T6441] name failslab, interval 1, probability 0, space 0, times 0 [ 261.295151][ T6446] ? create_io_worker+0x2f0/0x2f0 [ 261.295178][ T6446] create_io_thread+0x95/0xc0 [ 261.317470][ T6446] ? create_io_worker+0x2f0/0x2f0 [ 261.322503][ T6446] create_io_worker+0x1ac/0x2f0 [ 261.327395][ T6446] io_wqe_enqueue+0x692/0x7f0 [ 261.332063][ T6446] ? io_prep_async_work+0x300/0x320 [ 261.337272][ T6446] io_wq_enqueue+0x31/0x40 [ 261.341717][ T6446] io_queue_async_work+0x13a/0x320 [ 261.346812][ T6446] __io_queue_sqe+0x422/0x460 [ 261.351502][ T6446] io_submit_sqe+0x88b/0x3eb0 [ 261.356183][ T6446] ? kmem_cache_alloc_bulk+0x289/0x340 [ 261.361624][ T6446] io_submit_sqes+0x505/0xde0 [ 261.366285][ T6446] __se_sys_io_uring_enter+0x20d/0xb30 [ 261.371925][ T6446] ? __fget_light+0x21b/0x260 [ 261.376588][ T6446] ? fput+0x2d/0x130 [ 261.380470][ T6446] __x64_sys_io_uring_enter+0x74/0x80 [ 261.385914][ T6446] do_syscall_64+0x44/0xa0 [ 261.390355][ T6446] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 261.396386][ T6446] RIP: 0033:0x7fc02cad5a39 [ 261.400781][ T6446] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 261.421145][ T6446] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 261.429542][ T6446] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 261.437597][ T6446] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 261.445598][ T6446] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 261.453579][ T6446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 06:45:51 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 4) [ 261.461534][ T6446] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 261.469547][ T6441] CPU: 1 PID: 6441 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 261.478222][ T6441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 261.488268][ T6441] Call Trace: [ 261.491533][ T6441] dump_stack_lvl+0xd6/0x122 [ 261.496136][ T6441] dump_stack+0x11/0x1b [ 261.500292][ T6441] should_fail+0x23c/0x250 [ 261.504704][ T6441] __should_failslab+0x81/0x90 [ 261.509521][ T6441] should_failslab+0x5/0x20 [ 261.514024][ T6441] kmem_cache_alloc_bulk+0x40/0x340 [ 261.519257][ T6441] io_submit_sqes+0x548/0xde0 [ 261.523945][ T6441] __se_sys_io_uring_enter+0x20d/0xb30 [ 261.529487][ T6441] ? __fget_light+0x21b/0x260 [ 261.534139][ T6441] ? fput+0x2d/0x130 [ 261.538016][ T6441] __x64_sys_io_uring_enter+0x74/0x80 [ 261.543382][ T6441] do_syscall_64+0x44/0xa0 [ 261.547786][ T6441] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 261.553665][ T6441] RIP: 0033:0x7f60c072aa39 06:45:51 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0xf00, 0x0, 0x0, 0x0) [ 261.558057][ T6441] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 261.577714][ T6441] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 261.586159][ T6441] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 261.594117][ T6441] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 261.602077][ T6441] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 261.610025][ T6441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 261.611473][ T6456] FAULT_INJECTION: forcing a failure. [ 261.611473][ T6456] name failslab, interval 1, probability 0, space 0, times 0 [ 261.618005][ T6441] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 261.638732][ T6456] CPU: 0 PID: 6456 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 261.647402][ T6456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 261.657448][ T6456] Call Trace: [ 261.660750][ T6456] dump_stack_lvl+0xd6/0x122 [ 261.665339][ T6456] dump_stack+0x11/0x1b [ 261.669499][ T6456] should_fail+0x23c/0x250 [ 261.673901][ T6456] ? alloc_pid+0x71/0x760 [ 261.678288][ T6456] __should_failslab+0x81/0x90 [ 261.683039][ T6456] should_failslab+0x5/0x20 [ 261.687550][ T6456] kmem_cache_alloc+0x4f/0x300 [ 261.692301][ T6456] ? avc_has_perm+0xd5/0x160 [ 261.696895][ T6456] alloc_pid+0x71/0x760 [ 261.701127][ T6456] ? create_io_worker+0x2f0/0x2f0 [ 261.706135][ T6456] ? copy_thread+0x128/0x200 [ 261.710712][ T6456] copy_process+0x171c/0x2fa0 [ 261.715374][ T6456] ? create_io_worker+0x2f0/0x2f0 [ 261.720415][ T6456] create_io_thread+0x95/0xc0 [ 261.725177][ T6456] ? create_io_worker+0x2f0/0x2f0 [ 261.730184][ T6456] create_io_worker+0x1ac/0x2f0 [ 261.735070][ T6456] io_wqe_enqueue+0x692/0x7f0 [ 261.739733][ T6456] ? io_prep_async_work+0x300/0x320 [ 261.744972][ T6456] io_wq_enqueue+0x31/0x40 [ 261.749373][ T6456] io_queue_async_work+0x13a/0x320 [ 261.754472][ T6456] __io_queue_sqe+0x422/0x460 [ 261.759135][ T6456] io_submit_sqe+0x88b/0x3eb0 [ 261.763840][ T6456] ? kmem_cache_alloc_bulk+0x289/0x340 [ 261.769281][ T6456] io_submit_sqes+0x505/0xde0 [ 261.774015][ T6456] __se_sys_io_uring_enter+0x20d/0xb30 [ 261.779524][ T6456] ? __fget_light+0x21b/0x260 [ 261.784191][ T6456] ? fput+0x2d/0x130 [ 261.788110][ T6456] __x64_sys_io_uring_enter+0x74/0x80 [ 261.793515][ T6456] do_syscall_64+0x44/0xa0 [ 261.797939][ T6456] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 261.803819][ T6456] RIP: 0033:0x7fc02cad5a39 [ 261.808216][ T6456] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 261.827801][ T6456] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 261.836241][ T6456] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 261.844191][ T6456] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 261.852142][ T6456] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 06:45:51 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 14) 06:45:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0), &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 261.860112][ T6456] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 261.868076][ T6456] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 261.876719][ T6463] FAULT_INJECTION: forcing a failure. [ 261.876719][ T6463] name failslab, interval 1, probability 0, space 0, times 0 [ 261.889405][ T6463] CPU: 1 PID: 6463 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 261.898167][ T6463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 261.908237][ T6463] Call Trace: [ 261.911502][ T6463] dump_stack_lvl+0xd6/0x122 06:45:51 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 5) 06:45:51 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 261.916080][ T6463] dump_stack+0x11/0x1b [ 261.920330][ T6463] should_fail+0x23c/0x250 [ 261.924748][ T6463] ? xas_create+0x96b/0xb30 [ 261.929255][ T6463] __should_failslab+0x81/0x90 [ 261.934058][ T6463] should_failslab+0x5/0x20 [ 261.938735][ T6463] kmem_cache_alloc+0x4f/0x300 [ 261.943506][ T6463] ? xas_create+0x96b/0xb30 [ 261.948017][ T6463] xas_create+0x96b/0xb30 [ 261.952329][ T6463] xas_store+0x70/0xca0 [ 261.956540][ T6463] ? io_wq_create+0x217/0x6f0 [ 261.961216][ T6463] ? io_wq_create+0x4fc/0x6f0 06:45:51 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 261.965899][ T6463] __xa_store+0xdb/0x330 [ 261.970198][ T6463] xa_store+0x30/0x70 [ 261.974183][ T6463] io_uring_add_tctx_node+0x111/0x200 [ 261.979578][ T6463] __se_sys_io_uring_enter+0x1e0/0xb30 [ 261.985035][ T6463] ? __fget_light+0x21b/0x260 [ 261.989777][ T6463] ? fput+0x2d/0x130 [ 261.993707][ T6463] __x64_sys_io_uring_enter+0x74/0x80 [ 261.999072][ T6463] do_syscall_64+0x44/0xa0 [ 262.003507][ T6463] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 262.009471][ T6463] RIP: 0033:0x7f60c072aa39 [ 262.013864][ T6463] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 262.033583][ T6463] RSP: 002b:00007f60be480188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 262.041979][ T6463] RAX: ffffffffffffffda RBX: 00007f60c082e020 RCX: 00007f60c072aa39 [ 262.046282][ T6469] FAULT_INJECTION: forcing a failure. [ 262.046282][ T6469] name failslab, interval 1, probability 0, space 0, times 0 [ 262.049934][ T6463] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 262.049950][ T6463] RBP: 00007f60be4801d0 R08: 0000000000000000 R09: 0000000000000000 [ 262.049962][ T6463] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 262.049973][ T6463] R13: 00007ffc7a9da5ff R14: 00007f60be480300 R15: 0000000000022000 [ 262.063163][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 262.070652][ T6469] CPU: 0 PID: 6469 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 262.079200][ T379] loop2: p2 size 1073741824 extends beyond EOD, [ 262.086573][ T6469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 262.086584][ T6469] Call Trace: [ 262.086592][ T6469] dump_stack_lvl+0xd6/0x122 [ 262.086625][ T6469] dump_stack+0x11/0x1b [ 262.094593][ T379] truncated [ 262.099750][ T6469] should_fail+0x23c/0x250 [ 262.099770][ T6469] __should_failslab+0x81/0x90 [ 262.109421][ T379] loop2: p5 size 1073741824 extends beyond EOD, [ 262.114703][ T6469] should_failslab+0x5/0x20 [ 262.114727][ T6469] kmem_cache_alloc_node+0x61/0x2c0 [ 262.114745][ T6469] ? dup_task_struct+0x63/0x680 [ 262.124898][ T379] truncated [ 262.128152][ T6469] dup_task_struct+0x63/0x680 [ 262.177882][ T6469] copy_process+0x413/0x2fa0 [ 262.182474][ T6469] ? io_issue_sqe+0x6172/0x67b0 [ 262.187371][ T6469] ? rmqueue_pcplist+0x14e/0x1e0 [ 262.192316][ T6469] ? create_io_worker+0x2f0/0x2f0 [ 262.197328][ T6469] create_io_thread+0x95/0xc0 [ 262.201990][ T6469] ? create_io_worker+0x2f0/0x2f0 [ 262.207002][ T6469] create_io_worker+0x1ac/0x2f0 [ 262.211914][ T6469] io_wqe_enqueue+0x692/0x7f0 [ 262.216577][ T6469] ? io_prep_async_work+0x300/0x320 [ 262.221952][ T6469] io_wq_enqueue+0x31/0x40 [ 262.226453][ T6469] io_queue_async_work+0x13a/0x320 [ 262.231548][ T6469] __io_queue_sqe+0x422/0x460 [ 262.236223][ T6469] io_submit_sqe+0x88b/0x3eb0 [ 262.240883][ T6469] ? kmem_cache_alloc_bulk+0x289/0x340 [ 262.246342][ T6469] io_submit_sqes+0x505/0xde0 [ 262.251004][ T6469] __se_sys_io_uring_enter+0x20d/0xb30 [ 262.256446][ T6469] ? __fget_light+0x21b/0x260 [ 262.261110][ T6469] ? fput+0x2d/0x130 [ 262.265020][ T6469] __x64_sys_io_uring_enter+0x74/0x80 [ 262.270385][ T6469] do_syscall_64+0x44/0xa0 [ 262.274788][ T6469] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 262.280705][ T6469] RIP: 0033:0x7fc02cad5a39 [ 262.285104][ T6469] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 262.304778][ T6469] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:45:52 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 6) 06:45:52 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x2000, 0x0, 0x0, 0x0) [ 262.313168][ T6469] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 262.321130][ T6469] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 262.329135][ T6469] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 262.337175][ T6469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.345127][ T6469] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 262.473149][ T6485] FAULT_INJECTION: forcing a failure. [ 262.473149][ T6485] name failslab, interval 1, probability 0, space 0, times 0 [ 262.485937][ T6485] CPU: 1 PID: 6485 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 262.494607][ T6485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 262.504743][ T6485] Call Trace: [ 262.508076][ T6485] dump_stack_lvl+0xd6/0x122 [ 262.512657][ T6485] dump_stack+0x11/0x1b [ 262.516836][ T6485] should_fail+0x23c/0x250 [ 262.521261][ T6485] __should_failslab+0x81/0x90 [ 262.526006][ T6485] should_failslab+0x5/0x20 [ 262.530491][ T6485] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 262.536419][ T6485] ? __kmalloc_node+0x30/0x40 [ 262.541151][ T6485] ? __get_vm_area_node+0x226/0x260 [ 262.546433][ T6485] __kmalloc_node+0x30/0x40 [ 262.550988][ T6485] __vmalloc_node_range+0x231/0x600 [ 262.556204][ T6485] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 262.561669][ T6485] dup_task_struct+0x496/0x680 [ 262.566438][ T6485] ? copy_process+0x413/0x2fa0 [ 262.571204][ T6485] copy_process+0x413/0x2fa0 [ 262.575781][ T6485] ? io_issue_sqe+0x6172/0x67b0 [ 262.580718][ T6485] ? create_io_worker+0x2f0/0x2f0 [ 262.585811][ T6485] create_io_thread+0x95/0xc0 [ 262.590475][ T6485] ? create_io_worker+0x2f0/0x2f0 [ 262.595489][ T6485] create_io_worker+0x1ac/0x2f0 [ 262.600329][ T6485] io_wqe_enqueue+0x692/0x7f0 [ 262.605068][ T6485] ? io_prep_async_work+0x300/0x320 [ 262.610347][ T6485] io_wq_enqueue+0x31/0x40 [ 262.614748][ T6485] io_queue_async_work+0x13a/0x320 [ 262.619908][ T6485] __io_queue_sqe+0x422/0x460 [ 262.624568][ T6485] io_submit_sqe+0x88b/0x3eb0 [ 262.629311][ T6485] ? kmem_cache_alloc_bulk+0x289/0x340 [ 262.634839][ T6485] io_submit_sqes+0x505/0xde0 [ 262.639521][ T6485] __se_sys_io_uring_enter+0x20d/0xb30 [ 262.645006][ T6485] ? __fget_light+0x21b/0x260 [ 262.649667][ T6485] ? fput+0x2d/0x130 [ 262.653546][ T6485] __x64_sys_io_uring_enter+0x74/0x80 [ 262.658923][ T6485] do_syscall_64+0x44/0xa0 [ 262.663325][ T6485] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 262.669205][ T6485] RIP: 0033:0x7fc02cad5a39 [ 262.673602][ T6485] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 262.693195][ T6485] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 262.701659][ T6485] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 262.709618][ T6485] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 06:45:52 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 15) 06:45:52 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:52 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 7) [ 262.717570][ T6485] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 262.725529][ T6485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.733571][ T6485] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 262.747411][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 262.752979][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 262.766897][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:52 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:52 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x7bff, 0x0, 0x0, 0x0) 06:45:52 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 262.900096][ T6496] FAULT_INJECTION: forcing a failure. [ 262.900096][ T6496] name failslab, interval 1, probability 0, space 0, times 0 [ 262.912777][ T6496] CPU: 0 PID: 6496 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 262.920167][ T6494] FAULT_INJECTION: forcing a failure. [ 262.920167][ T6494] name failslab, interval 1, probability 0, space 0, times 0 [ 262.921448][ T6496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 262.921460][ T6496] Call Trace: [ 262.921467][ T6496] dump_stack_lvl+0xd6/0x122 [ 262.951880][ T6496] dump_stack+0x11/0x1b [ 262.956026][ T6496] should_fail+0x23c/0x250 [ 262.960425][ T6496] __should_failslab+0x81/0x90 [ 262.965190][ T6496] should_failslab+0x5/0x20 [ 262.969735][ T6496] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 262.975437][ T6496] ? __kmalloc_node+0x30/0x40 [ 262.980173][ T6496] ? __get_vm_area_node+0x226/0x260 [ 262.985355][ T6496] __kmalloc_node+0x30/0x40 [ 262.989845][ T6496] __vmalloc_node_range+0x231/0x600 [ 262.995030][ T6496] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 263.000472][ T6496] dup_task_struct+0x496/0x680 [ 263.005218][ T6496] ? copy_process+0x413/0x2fa0 [ 263.009964][ T6496] copy_process+0x413/0x2fa0 [ 263.014537][ T6496] ? io_issue_sqe+0x6172/0x67b0 [ 263.019394][ T6496] ? create_io_worker+0x2f0/0x2f0 [ 263.024406][ T6496] create_io_thread+0x95/0xc0 [ 263.029114][ T6496] ? create_io_worker+0x2f0/0x2f0 [ 263.034131][ T6496] create_io_worker+0x1ac/0x2f0 [ 263.038976][ T6496] io_wqe_enqueue+0x692/0x7f0 [ 263.043646][ T6496] ? io_prep_async_work+0x300/0x320 [ 263.048829][ T6496] io_wq_enqueue+0x31/0x40 [ 263.053278][ T6496] io_queue_async_work+0x13a/0x320 [ 263.058375][ T6496] __io_queue_sqe+0x422/0x460 [ 263.063106][ T6496] io_submit_sqe+0x88b/0x3eb0 [ 263.067809][ T6496] ? kmem_cache_alloc_bulk+0x289/0x340 [ 263.073390][ T6496] io_submit_sqes+0x505/0xde0 [ 263.078112][ T6496] __se_sys_io_uring_enter+0x20d/0xb30 [ 263.083555][ T6496] ? __fget_light+0x21b/0x260 [ 263.088220][ T6496] ? fput+0x2d/0x130 [ 263.092106][ T6496] __x64_sys_io_uring_enter+0x74/0x80 [ 263.097481][ T6496] do_syscall_64+0x44/0xa0 [ 263.101989][ T6496] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 263.107988][ T6496] RIP: 0033:0x7fc02cad5a39 [ 263.112391][ T6496] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 263.131989][ T6496] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 263.140393][ T6496] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 06:45:53 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 8) [ 263.148350][ T6496] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 263.156301][ T6496] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 263.164258][ T6496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 263.172262][ T6496] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 263.180324][ T6494] CPU: 1 PID: 6494 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 263.188995][ T6494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 263.199042][ T6494] Call Trace: [ 263.202314][ T6494] dump_stack_lvl+0xd6/0x122 [ 263.206983][ T6494] dump_stack+0x11/0x1b [ 263.211222][ T6494] should_fail+0x23c/0x250 [ 263.215627][ T6494] __should_failslab+0x81/0x90 [ 263.220389][ T6494] should_failslab+0x5/0x20 [ 263.224924][ T6494] kmem_cache_alloc_bulk+0x40/0x340 [ 263.230213][ T6494] io_submit_sqes+0x548/0xde0 [ 263.235060][ T6494] __se_sys_io_uring_enter+0x20d/0xb30 [ 263.240655][ T6494] ? __fget_light+0x21b/0x260 [ 263.245316][ T6494] ? fput+0x2d/0x130 [ 263.249209][ T6494] __x64_sys_io_uring_enter+0x74/0x80 [ 263.254643][ T6494] do_syscall_64+0x44/0xa0 [ 263.259043][ T6494] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 263.264974][ T6494] RIP: 0033:0x7f60c072aa39 [ 263.269368][ T6494] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 263.288972][ T6494] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 263.292724][ T6511] FAULT_INJECTION: forcing a failure. [ 263.292724][ T6511] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 263.297485][ T6494] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 263.297498][ T6494] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 263.297508][ T6494] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 263.297518][ T6494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 263.297530][ T6494] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 06:45:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 16) 06:45:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0xff7b, 0x0, 0x0, 0x0) [ 263.350847][ T6511] CPU: 0 PID: 6511 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 263.359520][ T6511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 263.369568][ T6511] Call Trace: [ 263.372829][ T6511] dump_stack_lvl+0xd6/0x122 [ 263.377428][ T6511] dump_stack+0x11/0x1b [ 263.381630][ T6511] should_fail+0x23c/0x250 [ 263.386023][ T6511] __alloc_pages_bulk+0xf9/0x710 [ 263.390960][ T6511] ? __kmalloc_node+0x30/0x40 [ 263.395622][ T6511] __vmalloc_node_range+0x2fe/0x600 [ 263.400808][ T6511] dup_task_struct+0x496/0x680 [ 263.405584][ T6511] ? copy_process+0x413/0x2fa0 [ 263.410329][ T6511] copy_process+0x413/0x2fa0 [ 263.414901][ T6511] ? io_issue_sqe+0x6172/0x67b0 [ 263.419782][ T6511] ? create_io_worker+0x2f0/0x2f0 [ 263.424868][ T6511] create_io_thread+0x95/0xc0 [ 263.429526][ T6511] ? create_io_worker+0x2f0/0x2f0 [ 263.434552][ T6511] create_io_worker+0x1ac/0x2f0 [ 263.439395][ T6511] io_wqe_enqueue+0x692/0x7f0 [ 263.444088][ T6511] ? io_prep_async_work+0x300/0x320 [ 263.449405][ T6511] io_wq_enqueue+0x31/0x40 [ 263.453813][ T6511] io_queue_async_work+0x13a/0x320 [ 263.458906][ T6511] __io_queue_sqe+0x422/0x460 [ 263.463567][ T6511] io_submit_sqe+0x88b/0x3eb0 [ 263.468237][ T6511] ? kmem_cache_alloc_bulk+0x289/0x340 [ 263.473762][ T6511] io_submit_sqes+0x505/0xde0 [ 263.478428][ T6511] __se_sys_io_uring_enter+0x20d/0xb30 [ 263.484179][ T6511] ? __fget_light+0x21b/0x260 [ 263.488838][ T6511] ? fput+0x2d/0x130 [ 263.492752][ T6511] __x64_sys_io_uring_enter+0x74/0x80 [ 263.498243][ T6511] do_syscall_64+0x44/0xa0 [ 263.502637][ T6511] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 263.508510][ T6511] RIP: 0033:0x7fc02cad5a39 [ 263.512900][ T6511] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 263.532573][ T6511] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 263.540985][ T6511] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 06:45:53 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 9) 06:45:53 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 263.548934][ T6511] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 263.556895][ T6511] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 263.564962][ T6511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 263.572911][ T6511] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 263.588192][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 263.594536][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated 06:45:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x1000000, 0x0, 0x0, 0x0) [ 263.622800][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 263.645703][ T6521] FAULT_INJECTION: forcing a failure. [ 263.645703][ T6521] name failslab, interval 1, probability 0, space 0, times 0 [ 263.658429][ T6521] CPU: 0 PID: 6521 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 263.667101][ T6521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 263.677163][ T6521] Call Trace: [ 263.680696][ T6521] dump_stack_lvl+0xd6/0x122 [ 263.685367][ T6521] dump_stack+0x11/0x1b [ 263.689514][ T6521] should_fail+0x23c/0x250 [ 263.693947][ T6521] __should_failslab+0x81/0x90 [ 263.698694][ T6521] should_failslab+0x5/0x20 [ 263.703182][ T6521] kmem_cache_alloc_bulk+0x40/0x340 [ 263.708361][ T6521] io_submit_sqes+0x548/0xde0 [ 263.713044][ T6521] __se_sys_io_uring_enter+0x20d/0xb30 [ 263.718485][ T6521] ? __fget_light+0x21b/0x260 [ 263.723206][ T6521] ? fput+0x2d/0x130 [ 263.727102][ T6521] __x64_sys_io_uring_enter+0x74/0x80 [ 263.732455][ T6521] do_syscall_64+0x44/0xa0 [ 263.736862][ T6521] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 263.742840][ T6521] RIP: 0033:0x7f60c072aa39 [ 263.747408][ T6521] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 263.766996][ T6521] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 263.775389][ T6521] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 263.783340][ T6521] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 263.791291][ T6521] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 263.799329][ T6521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 263.807331][ T6521] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 06:45:53 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 263.822434][ T6524] FAULT_INJECTION: forcing a failure. [ 263.822434][ T6524] name failslab, interval 1, probability 0, space 0, times 0 [ 263.835131][ T6524] CPU: 0 PID: 6524 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 263.843800][ T6524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 263.853848][ T6524] Call Trace: [ 263.857118][ T6524] dump_stack_lvl+0xd6/0x122 [ 263.861765][ T6524] dump_stack+0x11/0x1b [ 263.865919][ T6524] should_fail+0x23c/0x250 06:45:53 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:53 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 17) [ 263.870329][ T6524] __should_failslab+0x81/0x90 [ 263.875106][ T6524] ? io_drain_req+0x30c/0x610 [ 263.879858][ T6524] should_failslab+0x5/0x20 [ 263.884408][ T6524] kmem_cache_alloc_trace+0x52/0x320 [ 263.889865][ T6524] io_drain_req+0x30c/0x610 [ 263.894724][ T6524] io_submit_sqe+0x357e/0x3eb0 [ 263.899491][ T6524] ? kmem_cache_alloc_bulk+0x289/0x340 [ 263.904998][ T6524] io_submit_sqes+0x505/0xde0 [ 263.909677][ T6524] __se_sys_io_uring_enter+0x20d/0xb30 [ 263.915138][ T6524] ? __fget_light+0x21b/0x260 [ 263.917415][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 263.919903][ T6524] ? fput+0x2d/0x130 [ 263.919929][ T6524] __x64_sys_io_uring_enter+0x74/0x80 [ 263.925661][ T379] loop2: p2 size 1073741824 extends beyond EOD, [ 263.928973][ T6524] do_syscall_64+0x44/0xa0 [ 263.929041][ T6524] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 263.929066][ T6524] RIP: 0033:0x7fc02cad5a39 [ 263.934445][ T379] truncated [ 263.940722][ T6524] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 263.940740][ T6524] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 263.940758][ T6524] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 263.948218][ T379] loop2: p5 size 1073741824 extends beyond EOD, [ 263.951007][ T6524] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 263.951022][ T6524] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 06:45:53 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 10) 06:45:53 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x2000000, 0x0, 0x0, 0x0) [ 263.951034][ T6524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 263.955449][ T379] truncated [ 263.958508][ T6524] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 264.038108][ T6545] FAULT_INJECTION: forcing a failure. [ 264.038108][ T6545] name failslab, interval 1, probability 0, space 0, times 0 [ 264.050763][ T6545] CPU: 1 PID: 6545 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 264.059436][ T6545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 264.069482][ T6545] Call Trace: [ 264.072759][ T6545] dump_stack_lvl+0xd6/0x122 [ 264.077429][ T6545] dump_stack+0x11/0x1b [ 264.081658][ T6545] should_fail+0x23c/0x250 [ 264.086095][ T6545] __should_failslab+0x81/0x90 [ 264.090965][ T6545] should_failslab+0x5/0x20 [ 264.095497][ T6545] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 264.101218][ T6545] ? create_io_worker+0x66/0x2f0 [ 264.106231][ T6545] create_io_worker+0x66/0x2f0 [ 264.111082][ T6545] io_wqe_enqueue+0x692/0x7f0 [ 264.115872][ T6545] ? io_prep_async_work+0x300/0x320 [ 264.121131][ T6545] io_wq_enqueue+0x31/0x40 [ 264.125550][ T6545] io_queue_async_work+0x13a/0x320 [ 264.130653][ T6545] __io_queue_sqe+0x422/0x460 [ 264.135427][ T6545] io_submit_sqe+0x88b/0x3eb0 [ 264.140129][ T6545] ? kmem_cache_alloc_bulk+0x289/0x340 [ 264.145573][ T6545] io_submit_sqes+0x505/0xde0 [ 264.150248][ T6545] __se_sys_io_uring_enter+0x20d/0xb30 [ 264.155690][ T6545] ? __fget_light+0x21b/0x260 [ 264.160386][ T6545] ? fput+0x2d/0x130 [ 264.164273][ T6545] __x64_sys_io_uring_enter+0x74/0x80 [ 264.169711][ T6545] do_syscall_64+0x44/0xa0 [ 264.174226][ T6545] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 264.180125][ T6545] RIP: 0033:0x7f60c072aa39 [ 264.184528][ T6545] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 264.204134][ T6545] RSP: 002b:00007f60be480188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 264.212560][ T6545] RAX: ffffffffffffffda RBX: 00007f60c082e020 RCX: 00007f60c072aa39 [ 264.220522][ T6545] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 264.228476][ T6545] RBP: 00007f60be4801d0 R08: 0000000000000000 R09: 0000000000000000 [ 264.236432][ T6545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 264.244393][ T6545] R13: 00007ffc7a9da5ff R14: 00007f60be480300 R15: 0000000000022000 [ 264.323585][ T6551] FAULT_INJECTION: forcing a failure. [ 264.323585][ T6551] name failslab, interval 1, probability 0, space 0, times 0 [ 264.336313][ T6551] CPU: 0 PID: 6551 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 264.344979][ T6551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 264.355015][ T6551] Call Trace: [ 264.358288][ T6551] dump_stack_lvl+0xd6/0x122 [ 264.362892][ T6551] dump_stack+0x11/0x1b [ 264.367029][ T6551] should_fail+0x23c/0x250 [ 264.371420][ T6551] __should_failslab+0x81/0x90 [ 264.376167][ T6551] ? io_drain_req+0x30c/0x610 [ 264.380854][ T6551] should_failslab+0x5/0x20 [ 264.385383][ T6551] kmem_cache_alloc_trace+0x52/0x320 [ 264.390724][ T6551] io_drain_req+0x30c/0x610 [ 264.395207][ T6551] io_submit_sqe+0x357e/0x3eb0 [ 264.400042][ T6551] ? kmem_cache_alloc_bulk+0x289/0x340 [ 264.405480][ T6551] io_submit_sqes+0x505/0xde0 [ 264.410190][ T6551] __se_sys_io_uring_enter+0x20d/0xb30 [ 264.415689][ T6551] ? __fget_light+0x21b/0x260 [ 264.420383][ T6551] ? fput+0x2d/0x130 [ 264.424275][ T6551] __x64_sys_io_uring_enter+0x74/0x80 [ 264.429636][ T6551] do_syscall_64+0x44/0xa0 [ 264.434120][ T6551] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 264.440454][ T6551] RIP: 0033:0x7fc02cad5a39 [ 264.444845][ T6551] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 264.464484][ T6551] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:45:54 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 264.473167][ T6551] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 264.481116][ T6551] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 264.489155][ T6551] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 264.497121][ T6551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 264.505173][ T6551] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:45:54 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 11) [ 264.674142][ T6564] FAULT_INJECTION: forcing a failure. [ 264.674142][ T6564] name failslab, interval 1, probability 0, space 0, times 0 [ 264.686768][ T6564] CPU: 0 PID: 6564 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 264.695444][ T6564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 264.705475][ T6564] Call Trace: [ 264.708793][ T6564] dump_stack_lvl+0xd6/0x122 [ 264.713369][ T6564] dump_stack+0x11/0x1b [ 264.717562][ T6564] should_fail+0x23c/0x250 [ 264.721977][ T6564] __should_failslab+0x81/0x90 [ 264.726832][ T6564] ? io_drain_req+0x30c/0x610 [ 264.731486][ T6564] should_failslab+0x5/0x20 [ 264.736036][ T6564] kmem_cache_alloc_trace+0x52/0x320 [ 264.741302][ T6564] io_drain_req+0x30c/0x610 [ 264.745810][ T6564] io_submit_sqe+0x357e/0x3eb0 [ 264.750567][ T6564] ? kmem_cache_alloc_bulk+0x289/0x340 [ 264.756038][ T6564] io_submit_sqes+0x505/0xde0 [ 264.760768][ T6564] __se_sys_io_uring_enter+0x20d/0xb30 [ 264.766286][ T6564] ? __fget_light+0x21b/0x260 [ 264.771014][ T6564] ? fput+0x2d/0x130 [ 264.774934][ T6564] ? fpregs_restore_userregs+0x10c/0x1c0 [ 264.780557][ T6564] __x64_sys_io_uring_enter+0x74/0x80 [ 264.785914][ T6564] do_syscall_64+0x44/0xa0 [ 264.790340][ T6564] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 264.796273][ T6564] RIP: 0033:0x7fc02cad5a39 [ 264.800688][ T6564] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 06:45:54 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 18) 06:45:54 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 264.820276][ T6564] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 264.828672][ T6564] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 264.836672][ T6564] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 264.844727][ T6564] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 264.852678][ T6564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 264.860628][ T6564] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:45:54 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:54 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 12) 06:45:54 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x6000000, 0x0, 0x0, 0x0) [ 264.881983][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 264.887662][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 264.898175][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 264.982019][ T6573] FAULT_INJECTION: forcing a failure. [ 264.982019][ T6573] name failslab, interval 1, probability 0, space 0, times 0 [ 264.994690][ T6573] CPU: 0 PID: 6573 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 265.003354][ T6573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 265.013397][ T6573] Call Trace: [ 265.016672][ T6573] dump_stack_lvl+0xd6/0x122 [ 265.021250][ T6573] dump_stack+0x11/0x1b [ 265.025395][ T6573] should_fail+0x23c/0x250 [ 265.029839][ T6573] __should_failslab+0x81/0x90 [ 265.034630][ T6573] ? io_drain_req+0x30c/0x610 [ 265.039381][ T6573] should_failslab+0x5/0x20 [ 265.043867][ T6573] kmem_cache_alloc_trace+0x52/0x320 [ 265.049252][ T6573] io_drain_req+0x30c/0x610 [ 265.053743][ T6573] io_submit_sqe+0x357e/0x3eb0 [ 265.058549][ T6573] ? kmem_cache_alloc_bulk+0x289/0x340 [ 265.063991][ T6573] io_submit_sqes+0x505/0xde0 [ 265.068753][ T6573] __se_sys_io_uring_enter+0x20d/0xb30 [ 265.074206][ T6573] ? __fget_light+0x21b/0x260 [ 265.078881][ T6573] ? fput+0x2d/0x130 [ 265.082871][ T6573] __x64_sys_io_uring_enter+0x74/0x80 [ 265.088341][ T6573] do_syscall_64+0x44/0xa0 [ 265.092865][ T6573] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 265.098758][ T6573] RIP: 0033:0x7fc02cad5a39 [ 265.103160][ T6573] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 265.123215][ T6573] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 265.131691][ T6573] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 265.139828][ T6573] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 265.147774][ T6573] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 265.155722][ T6573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 265.163770][ T6573] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 265.173818][ T6571] FAULT_INJECTION: forcing a failure. [ 265.173818][ T6571] name failslab, interval 1, probability 0, space 0, times 0 [ 265.186471][ T6571] CPU: 0 PID: 6571 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 265.195274][ T6571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 265.205320][ T6571] Call Trace: [ 265.208585][ T6571] dump_stack_lvl+0xd6/0x122 [ 265.213297][ T6571] dump_stack+0x11/0x1b [ 265.217445][ T6571] should_fail+0x23c/0x250 [ 265.221846][ T6571] __should_failslab+0x81/0x90 [ 265.226613][ T6571] should_failslab+0x5/0x20 [ 265.231152][ T6571] kmem_cache_alloc_node+0x61/0x2c0 [ 265.236333][ T6571] ? dup_task_struct+0x63/0x680 [ 265.241179][ T6571] dup_task_struct+0x63/0x680 [ 265.245913][ T6571] ? cpumask_next+0x69/0x80 [ 265.250437][ T6571] copy_process+0x413/0x2fa0 [ 265.255101][ T6571] ? io_issue_sqe+0x6172/0x67b0 [ 265.259983][ T6571] ? create_io_worker+0x2f0/0x2f0 [ 265.264995][ T6571] create_io_thread+0x95/0xc0 [ 265.269666][ T6571] ? create_io_worker+0x2f0/0x2f0 [ 265.274683][ T6571] create_io_worker+0x1ac/0x2f0 [ 265.279530][ T6571] io_wqe_enqueue+0x692/0x7f0 [ 265.284204][ T6571] ? io_prep_async_work+0x300/0x320 [ 265.289415][ T6571] io_wq_enqueue+0x31/0x40 [ 265.293810][ T6571] io_queue_async_work+0x13a/0x320 [ 265.298974][ T6571] __io_queue_sqe+0x422/0x460 [ 265.303629][ T6571] io_submit_sqe+0x88b/0x3eb0 [ 265.308319][ T6571] ? kmem_cache_alloc_bulk+0x289/0x340 [ 265.313758][ T6571] io_submit_sqes+0x505/0xde0 [ 265.318549][ T6571] __se_sys_io_uring_enter+0x20d/0xb30 [ 265.323985][ T6571] ? __fget_light+0x21b/0x260 [ 265.327271][ T6587] FAULT_INJECTION: forcing a failure. [ 265.327271][ T6587] name failslab, interval 1, probability 0, space 0, times 0 [ 265.328736][ T6571] ? fput+0x2d/0x130 [ 265.328762][ T6571] __x64_sys_io_uring_enter+0x74/0x80 [ 265.350696][ T6571] do_syscall_64+0x44/0xa0 [ 265.355130][ T6571] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 265.361089][ T6571] RIP: 0033:0x7f60c072aa39 06:45:55 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 13) [ 265.365554][ T6571] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 265.385140][ T6571] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 265.393550][ T6571] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 265.401511][ T6571] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 265.409528][ T6571] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 265.417480][ T6571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 265.425524][ T6571] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 265.433494][ T6587] CPU: 1 PID: 6587 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 265.442167][ T6587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 265.452210][ T6587] Call Trace: [ 265.455521][ T6587] dump_stack_lvl+0xd6/0x122 [ 265.460238][ T6587] dump_stack+0x11/0x1b [ 265.464545][ T6587] should_fail+0x23c/0x250 [ 265.468940][ T6587] __should_failslab+0x81/0x90 [ 265.473702][ T6587] ? io_drain_req+0x30c/0x610 [ 265.478406][ T6587] should_failslab+0x5/0x20 06:45:55 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:55 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x7000000, 0x0, 0x0, 0x0) 06:45:55 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 19) [ 265.482900][ T6587] kmem_cache_alloc_trace+0x52/0x320 [ 265.488205][ T6587] io_drain_req+0x30c/0x610 [ 265.492755][ T6587] io_submit_sqe+0x357e/0x3eb0 [ 265.497527][ T6587] ? kmem_cache_alloc_bulk+0x289/0x340 [ 265.503059][ T6587] io_submit_sqes+0x505/0xde0 [ 265.507851][ T6587] __se_sys_io_uring_enter+0x20d/0xb30 [ 265.513308][ T6587] ? __fget_light+0x21b/0x260 [ 265.518011][ T6587] ? fput+0x2d/0x130 [ 265.521953][ T6587] __x64_sys_io_uring_enter+0x74/0x80 [ 265.527370][ T6587] do_syscall_64+0x44/0xa0 [ 265.531772][ T6587] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 265.537652][ T6587] RIP: 0033:0x7fc02cad5a39 [ 265.542084][ T6587] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 265.561673][ T6587] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 265.570079][ T6587] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 265.578066][ T6587] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 265.586019][ T6587] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 265.594015][ T6587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 265.602054][ T6587] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 265.618545][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 265.626204][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated 06:45:55 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 14) [ 265.634328][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:55 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 265.713520][ T6601] FAULT_INJECTION: forcing a failure. [ 265.713520][ T6601] name failslab, interval 1, probability 0, space 0, times 0 [ 265.726181][ T6601] CPU: 1 PID: 6601 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 265.734833][ T6601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 265.744872][ T6601] Call Trace: [ 265.748138][ T6601] dump_stack_lvl+0xd6/0x122 [ 265.752804][ T6601] dump_stack+0x11/0x1b [ 265.756961][ T6601] should_fail+0x23c/0x250 06:45:55 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 265.761359][ T6601] __should_failslab+0x81/0x90 [ 265.766111][ T6601] ? io_drain_req+0x30c/0x610 [ 265.770785][ T6601] should_failslab+0x5/0x20 [ 265.775352][ T6601] kmem_cache_alloc_trace+0x52/0x320 [ 265.780615][ T6601] io_drain_req+0x30c/0x610 [ 265.785133][ T6601] io_submit_sqe+0x357e/0x3eb0 [ 265.789881][ T6601] ? kmem_cache_alloc_bulk+0x289/0x340 [ 265.795314][ T6601] io_submit_sqes+0x505/0xde0 [ 265.799981][ T6601] __se_sys_io_uring_enter+0x20d/0xb30 [ 265.805432][ T6601] ? __fget_light+0x21b/0x260 [ 265.810145][ T6601] ? fput+0x2d/0x130 [ 265.814043][ T6601] __x64_sys_io_uring_enter+0x74/0x80 [ 265.819412][ T6601] do_syscall_64+0x44/0xa0 [ 265.823820][ T6601] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 265.829704][ T6601] RIP: 0033:0x7fc02cad5a39 [ 265.834102][ T6601] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 265.853682][ T6601] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 265.862091][ T6601] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 265.870057][ T6601] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 265.878081][ T6601] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 265.886090][ T6601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 265.894037][ T6601] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 265.902408][ T6599] FAULT_INJECTION: forcing a failure. [ 265.902408][ T6599] name failslab, interval 1, probability 0, space 0, times 0 [ 265.915024][ T6599] CPU: 1 PID: 6599 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 265.923685][ T6599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 265.933715][ T6599] Call Trace: [ 265.937011][ T6599] dump_stack_lvl+0xd6/0x122 [ 265.941689][ T6599] dump_stack+0x11/0x1b [ 265.945836][ T6599] should_fail+0x23c/0x250 [ 265.950240][ T6599] __should_failslab+0x81/0x90 [ 265.955082][ T6599] should_failslab+0x5/0x20 06:45:55 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 15) [ 265.959952][ T6599] kmem_cache_alloc_bulk+0x40/0x340 [ 265.965135][ T6599] io_submit_sqes+0x548/0xde0 [ 265.969819][ T6599] __se_sys_io_uring_enter+0x20d/0xb30 [ 265.975277][ T6599] ? __fget_light+0x21b/0x260 [ 265.979938][ T6599] ? fput+0x2d/0x130 [ 265.983814][ T6599] __x64_sys_io_uring_enter+0x74/0x80 [ 265.989172][ T6599] do_syscall_64+0x44/0xa0 [ 265.993576][ T6599] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 265.999467][ T6599] RIP: 0033:0x7f60c072aa39 [ 266.003917][ T6599] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 266.023530][ T6599] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 266.032041][ T6599] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 266.039996][ T6599] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 266.047974][ T6599] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 266.055926][ T6599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 06:45:55 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 20) [ 266.063884][ T6599] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 266.091851][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 266.098148][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 266.105975][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 266.178093][ T6615] FAULT_INJECTION: forcing a failure. [ 266.178093][ T6615] name failslab, interval 1, probability 0, space 0, times 0 [ 266.190717][ T6615] CPU: 1 PID: 6615 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 266.199379][ T6615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 266.199796][ T6618] FAULT_INJECTION: forcing a failure. [ 266.199796][ T6618] name failslab, interval 1, probability 0, space 0, times 0 [ 266.209530][ T6615] Call Trace: [ 266.209539][ T6615] dump_stack_lvl+0xd6/0x122 [ 266.209563][ T6615] dump_stack+0x11/0x1b [ 266.209580][ T6615] should_fail+0x23c/0x250 [ 266.238534][ T6615] __should_failslab+0x81/0x90 [ 266.243314][ T6615] ? io_drain_req+0x30c/0x610 [ 266.247989][ T6615] should_failslab+0x5/0x20 [ 266.252475][ T6615] kmem_cache_alloc_trace+0x52/0x320 [ 266.257791][ T6615] io_drain_req+0x30c/0x610 [ 266.262307][ T6615] io_submit_sqe+0x357e/0x3eb0 [ 266.267055][ T6615] ? kmem_cache_alloc_bulk+0x289/0x340 [ 266.272568][ T6615] io_submit_sqes+0x505/0xde0 [ 266.277241][ T6615] __se_sys_io_uring_enter+0x20d/0xb30 [ 266.282720][ T6615] ? __fget_light+0x21b/0x260 [ 266.287489][ T6615] ? fput+0x2d/0x130 [ 266.291366][ T6615] __x64_sys_io_uring_enter+0x74/0x80 [ 266.296730][ T6615] do_syscall_64+0x44/0xa0 [ 266.301181][ T6615] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 266.307593][ T6615] RIP: 0033:0x7fc02cad5a39 [ 266.312055][ T6615] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 266.331650][ T6615] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 266.340043][ T6615] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 266.347996][ T6615] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 266.355950][ T6615] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 266.363941][ T6615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 266.371891][ T6615] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 266.379846][ T6618] CPU: 0 PID: 6618 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 266.388517][ T6618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 266.398658][ T6618] Call Trace: [ 266.401925][ T6618] dump_stack_lvl+0xd6/0x122 [ 266.406583][ T6618] dump_stack+0x11/0x1b [ 266.410738][ T6618] should_fail+0x23c/0x250 [ 266.415214][ T6618] __should_failslab+0x81/0x90 [ 266.420056][ T6618] should_failslab+0x5/0x20 06:45:56 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 16) 06:45:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 266.424557][ T6618] kmem_cache_alloc_bulk+0x40/0x340 [ 266.429755][ T6618] io_submit_sqes+0x548/0xde0 [ 266.434547][ T6618] __se_sys_io_uring_enter+0x20d/0xb30 [ 266.440034][ T6618] ? __fget_light+0x21b/0x260 [ 266.444716][ T6618] ? fput+0x2d/0x130 [ 266.448589][ T6618] __x64_sys_io_uring_enter+0x74/0x80 [ 266.453950][ T6618] do_syscall_64+0x44/0xa0 [ 266.458349][ T6618] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 266.464266][ T6618] RIP: 0033:0x7f60c072aa39 [ 266.468660][ T6618] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 266.487590][ T6625] FAULT_INJECTION: forcing a failure. [ 266.487590][ T6625] name failslab, interval 1, probability 0, space 0, times 0 [ 266.488328][ T6618] RSP: 002b:00007f60be4a1188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 266.488350][ T6618] RAX: ffffffffffffffda RBX: 00007f60c082df60 RCX: 00007f60c072aa39 [ 266.517271][ T6618] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 266.525231][ T6618] RBP: 00007f60be4a11d0 R08: 0000000000000000 R09: 0000000000000000 [ 266.533183][ T6618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 266.541134][ T6618] R13: 00007ffc7a9da5ff R14: 00007f60be4a1300 R15: 0000000000022000 [ 266.549135][ T6625] CPU: 1 PID: 6625 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 266.557805][ T6625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 266.567844][ T6625] Call Trace: [ 266.571110][ T6625] dump_stack_lvl+0xd6/0x122 [ 266.575693][ T6625] dump_stack+0x11/0x1b [ 266.579837][ T6625] should_fail+0x23c/0x250 [ 266.584406][ T6625] __should_failslab+0x81/0x90 [ 266.589178][ T6625] ? io_drain_req+0x30c/0x610 [ 266.593878][ T6625] should_failslab+0x5/0x20 [ 266.598392][ T6625] kmem_cache_alloc_trace+0x52/0x320 [ 266.603686][ T6625] io_drain_req+0x30c/0x610 [ 266.608182][ T6625] io_submit_sqe+0x357e/0x3eb0 [ 266.612952][ T6625] ? kmem_cache_alloc_bulk+0x289/0x340 [ 266.618652][ T6625] io_submit_sqes+0x505/0xde0 [ 266.623329][ T6625] __se_sys_io_uring_enter+0x20d/0xb30 [ 266.628777][ T6625] ? __fget_light+0x21b/0x260 [ 266.633458][ T6625] ? fput+0x2d/0x130 [ 266.637358][ T6625] __x64_sys_io_uring_enter+0x74/0x80 [ 266.642718][ T6625] do_syscall_64+0x44/0xa0 [ 266.647150][ T6625] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 266.653036][ T6625] RIP: 0033:0x7fc02cad5a39 [ 266.657448][ T6625] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 06:45:56 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 21) 06:45:56 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r4, r3, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 266.677038][ T6625] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 266.685431][ T6625] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 266.693385][ T6625] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 266.701428][ T6625] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 266.709381][ T6625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 266.717352][ T6625] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:45:56 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 17) [ 266.727089][ T6632] FAULT_INJECTION: forcing a failure. [ 266.727089][ T6632] name failslab, interval 1, probability 0, space 0, times 0 [ 266.739785][ T6632] CPU: 0 PID: 6632 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 266.748454][ T6632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 266.758509][ T6632] Call Trace: [ 266.761783][ T6632] dump_stack_lvl+0xd6/0x122 [ 266.766374][ T6632] dump_stack+0x11/0x1b [ 266.770527][ T6632] should_fail+0x23c/0x250 [ 266.774939][ T6632] __should_failslab+0x81/0x90 [ 266.779694][ T6632] should_failslab+0x5/0x20 [ 266.784182][ T6632] kmem_cache_alloc_node_trace+0x61/0x2e0 [ 266.789884][ T6632] ? __get_vm_area_node+0x11b/0x260 [ 266.795068][ T6632] __get_vm_area_node+0x11b/0x260 [ 266.800067][ T6632] __vmalloc_node_range+0xb2/0x600 [ 266.805278][ T6632] ? copy_process+0x413/0x2fa0 [ 266.810110][ T6632] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 266.815548][ T6632] dup_task_struct+0x496/0x680 [ 266.820293][ T6632] ? copy_process+0x413/0x2fa0 [ 266.822195][ T6636] FAULT_INJECTION: forcing a failure. [ 266.822195][ T6636] name failslab, interval 1, probability 0, space 0, times 0 [ 266.825110][ T6632] copy_process+0x413/0x2fa0 [ 266.825131][ T6632] ? io_issue_sqe+0x6172/0x67b0 [ 266.848459][ T6632] ? rmqueue_pcplist+0x14e/0x1e0 [ 266.853433][ T6632] ? create_io_worker+0x2f0/0x2f0 [ 266.858447][ T6632] create_io_thread+0x95/0xc0 [ 266.863250][ T6632] ? create_io_worker+0x2f0/0x2f0 [ 266.868341][ T6632] create_io_worker+0x1ac/0x2f0 [ 266.873348][ T6632] io_wqe_enqueue+0x692/0x7f0 [ 266.878017][ T6632] ? io_prep_async_work+0x300/0x320 [ 266.883227][ T6632] io_wq_enqueue+0x31/0x40 [ 266.887635][ T6632] io_queue_async_work+0x13a/0x320 [ 266.892747][ T6632] __io_queue_sqe+0x422/0x460 [ 266.897497][ T6632] io_submit_sqe+0x88b/0x3eb0 [ 266.902283][ T6632] ? kmem_cache_alloc_bulk+0x289/0x340 [ 266.907919][ T6632] io_submit_sqes+0x505/0xde0 [ 266.912747][ T6632] __se_sys_io_uring_enter+0x20d/0xb30 [ 266.918228][ T6632] ? __fget_light+0x21b/0x260 [ 266.922927][ T6632] ? fput+0x2d/0x130 [ 266.926812][ T6632] __x64_sys_io_uring_enter+0x74/0x80 [ 266.932174][ T6632] do_syscall_64+0x44/0xa0 [ 266.937726][ T6632] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 266.943715][ T6632] RIP: 0033:0x7f60c072aa39 [ 266.948551][ T6632] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 266.968233][ T6632] RSP: 002b:00007f60be480188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 266.976637][ T6632] RAX: ffffffffffffffda RBX: 00007f60c082e020 RCX: 00007f60c072aa39 [ 266.984591][ T6632] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 266.992542][ T6632] RBP: 00007f60be4801d0 R08: 0000000000000000 R09: 0000000000000000 [ 267.000673][ T6632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 267.008631][ T6632] R13: 00007ffc7a9da5ff R14: 00007f60be480300 R15: 0000000000022000 [ 267.016600][ T6636] CPU: 1 PID: 6636 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 267.016640][ T6632] syz-executor.2: vmalloc error: size 16384, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz2 [ 267.025313][ T6636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 267.025325][ T6632] ,mems_allowed=0 [ 267.039255][ T6636] Call Trace: [ 267.039263][ T6636] dump_stack_lvl+0xd6/0x122 [ 267.039285][ T6636] dump_stack+0x11/0x1b [ 267.049346][ T6632] [ 267.067247][ T6636] should_fail+0x23c/0x250 [ 267.071657][ T6636] __should_failslab+0x81/0x90 [ 267.076419][ T6636] ? io_drain_req+0x30c/0x610 [ 267.081087][ T6636] should_failslab+0x5/0x20 [ 267.085573][ T6636] kmem_cache_alloc_trace+0x52/0x320 [ 267.090877][ T6636] io_drain_req+0x30c/0x610 [ 267.095380][ T6636] io_submit_sqe+0x357e/0x3eb0 [ 267.100145][ T6636] ? kmem_cache_alloc_bulk+0x289/0x340 [ 267.105591][ T6636] io_submit_sqes+0x505/0xde0 [ 267.110261][ T6636] __se_sys_io_uring_enter+0x20d/0xb30 [ 267.115862][ T6636] ? __fget_light+0x21b/0x260 [ 267.120521][ T6636] ? fput+0x2d/0x130 [ 267.124501][ T6636] __x64_sys_io_uring_enter+0x74/0x80 [ 267.129899][ T6636] do_syscall_64+0x44/0xa0 [ 267.134372][ T6636] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 267.140252][ T6636] RIP: 0033:0x7fc02cad5a39 [ 267.144657][ T6636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 267.164274][ T6636] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 267.172801][ T6636] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 267.180794][ T6636] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 267.188751][ T6636] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 267.196708][ T6636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 267.204733][ T6636] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 267.212688][ T6632] CPU: 0 PID: 6632 Comm: syz-executor.2 Not tainted 5.15.0-rc5-syzkaller #0 [ 267.221971][ T6632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 267.232023][ T6632] Call Trace: [ 267.235301][ T6632] dump_stack_lvl+0xd6/0x122 [ 267.239896][ T6632] dump_stack+0x11/0x1b [ 267.244078][ T6632] warn_alloc+0x132/0x190 [ 267.248437][ T6632] __vmalloc_node_range+0x207/0x600 [ 267.253620][ T6632] ? kmem_cache_alloc_node+0x1e6/0x2c0 [ 267.259059][ T6632] dup_task_struct+0x496/0x680 [ 267.263854][ T6632] ? copy_process+0x413/0x2fa0 [ 267.268726][ T6632] copy_process+0x413/0x2fa0 [ 267.273661][ T6632] ? io_issue_sqe+0x6172/0x67b0 [ 267.278509][ T6632] ? rmqueue_pcplist+0x14e/0x1e0 [ 267.283429][ T6632] ? create_io_worker+0x2f0/0x2f0 [ 267.288458][ T6632] create_io_thread+0x95/0xc0 [ 267.293152][ T6632] ? create_io_worker+0x2f0/0x2f0 [ 267.298277][ T6632] create_io_worker+0x1ac/0x2f0 [ 267.303113][ T6632] io_wqe_enqueue+0x692/0x7f0 [ 267.307769][ T6632] ? io_prep_async_work+0x300/0x320 [ 267.312974][ T6632] io_wq_enqueue+0x31/0x40 [ 267.317369][ T6632] io_queue_async_work+0x13a/0x320 [ 267.322536][ T6632] __io_queue_sqe+0x422/0x460 [ 267.327191][ T6632] io_submit_sqe+0x88b/0x3eb0 [ 267.331847][ T6632] ? kmem_cache_alloc_bulk+0x289/0x340 [ 267.337296][ T6632] io_submit_sqes+0x505/0xde0 [ 267.341967][ T6632] __se_sys_io_uring_enter+0x20d/0xb30 [ 267.347445][ T6632] ? __fget_light+0x21b/0x260 [ 267.352115][ T6632] ? fput+0x2d/0x130 [ 267.356009][ T6632] __x64_sys_io_uring_enter+0x74/0x80 [ 267.361357][ T6632] do_syscall_64+0x44/0xa0 [ 267.365806][ T6632] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 267.371690][ T6632] RIP: 0033:0x7f60c072aa39 [ 267.376081][ T6632] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 267.395676][ T6632] RSP: 002b:00007f60be480188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 267.404084][ T6632] RAX: ffffffffffffffda RBX: 00007f60c082e020 RCX: 00007f60c072aa39 [ 267.412101][ T6632] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 267.420051][ T6632] RBP: 00007f60be4801d0 R08: 0000000000000000 R09: 0000000000000000 [ 267.428010][ T6632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 267.436223][ T6632] R13: 00007ffc7a9da5ff R14: 00007f60be480300 R15: 0000000000022000 [ 267.444505][ T6632] Mem-Info: [ 267.447671][ T6632] active_anon:370 inactive_anon:72647 isolated_anon:0 [ 267.447671][ T6632] active_file:3317 inactive_file:55023 isolated_file:0 [ 267.447671][ T6632] unevictable:0 dirty:55 writeback:0 [ 267.447671][ T6632] slab_reclaimable:3870 slab_unreclaimable:5174 [ 267.447671][ T6632] mapped:58174 shmem:418 pagetables:1142 bounce:0 [ 267.447671][ T6632] kernel_misc_reclaimable:0 [ 267.447671][ T6632] free:1823533 free_pcp:3108 free_cma:0 [ 267.489161][ T6632] Node 0 active_anon:1480kB inactive_anon:290588kB active_file:13268kB inactive_file:220092kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:232696kB dirty:220kB writeback:0kB shmem:1672kB writeback_tmp:0kB kernel_stack:1904kB pagetables:4568kB all_unreclaimable? no [ 267.515927][ T6632] Node 0 DMA free:15360kB min:20kB low:32kB high:44kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 267.542215][ T6632] lowmem_reserve[]: 0 2942 7920 7920 [ 267.547632][ T6632] Node 0 DMA32 free:3014332kB min:4224kB low:7236kB high:10248kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:3017192kB mlocked:0kB bounce:0kB free_pcp:2860kB local_pcp:56kB free_cma:0kB [ 267.575378][ T6632] lowmem_reserve[]: 0 0 4978 4978 [ 267.580444][ T6632] Node 0 Normal free:4264440kB min:7152kB low:12248kB high:17344kB reserved_highatomic:0KB active_anon:1480kB inactive_anon:290588kB active_file:13268kB inactive_file:220092kB unevictable:0kB writepending:220kB present:5242880kB managed:5098288kB mlocked:0kB bounce:0kB free_pcp:9924kB local_pcp:4280kB free_cma:0kB [ 267.610041][ T6632] lowmem_reserve[]: 0 0 0 0 [ 267.614594][ T6632] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 267.627240][ T6632] Node 0 DMA32: 3*4kB (M) 2*8kB (M) 4*16kB (M) 5*32kB (M) 5*64kB (M) 3*128kB (M) 3*256kB (M) 4*512kB (M) 2*1024kB (M) 1*2048kB (M) 734*4096kB (M) = 3014332kB [ 267.643317][ T6632] Node 0 Normal: 74*4kB (UM) 114*8kB (UME) 50*16kB (UME) 87*32kB (UME) 55*64kB (UM) 51*128kB (UME) 16*256kB (M) 12*512kB (UME) 4*1024kB (UM) 4*2048kB (UM) 1032*4096kB (M) = 4264440kB [ 267.661993][ T6632] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 267.671453][ T6632] 12247 total pagecache pages [ 267.676148][ T6632] 0 pages in swap cache [ 267.680303][ T6632] Swap cache stats: add 0, delete 0, find 0/0 [ 267.686374][ T6632] Free swap = 0kB [ 267.690094][ T6632] Total swap = 0kB [ 267.693795][ T6632] 2097051 pages RAM [ 267.697595][ T6632] 0 pages HighMem/MovableOnly [ 267.702251][ T6632] 64341 pages reserved [ 267.710181][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 267.716721][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 267.724669][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 267.757472][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 267.763042][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 267.770996][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:58 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0xf000000, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 18) 06:45:58 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 268.560315][ T6651] FAULT_INJECTION: forcing a failure. [ 268.560315][ T6651] name failslab, interval 1, probability 0, space 0, times 0 [ 268.573231][ T6651] CPU: 1 PID: 6651 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 268.581902][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 268.591993][ T6651] Call Trace: [ 268.595272][ T6651] dump_stack_lvl+0xd6/0x122 [ 268.599871][ T6651] dump_stack+0x11/0x1b [ 268.604076][ T6651] should_fail+0x23c/0x250 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 268.608551][ T6651] __should_failslab+0x81/0x90 [ 268.613328][ T6651] ? io_drain_req+0x30c/0x610 [ 268.618213][ T6651] should_failslab+0x5/0x20 [ 268.622794][ T6651] kmem_cache_alloc_trace+0x52/0x320 [ 268.628185][ T6651] io_drain_req+0x30c/0x610 [ 268.632696][ T6651] io_submit_sqe+0x357e/0x3eb0 [ 268.637464][ T6651] ? kmem_cache_alloc_bulk+0x289/0x340 [ 268.642924][ T6651] io_submit_sqes+0x505/0xde0 [ 268.647696][ T6651] __se_sys_io_uring_enter+0x20d/0xb30 [ 268.653157][ T6651] __x64_sys_io_uring_enter+0x74/0x80 [ 268.658592][ T6651] do_syscall_64+0x44/0xa0 [ 268.663151][ T6651] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 268.669096][ T6651] RIP: 0033:0x7fc02cad5a39 [ 268.673623][ T6651] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 268.693367][ T6651] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 268.701871][ T6651] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 268.710015][ T6651] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 268.718086][ T6651] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 268.726062][ T6651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 268.734162][ T6651] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 268.775802][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 268.781565][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 268.789995][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:45:58 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x20000000, 0x0, 0x0, 0x0) 06:45:58 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:45:58 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 19) [ 269.067727][ T6684] FAULT_INJECTION: forcing a failure. [ 269.067727][ T6684] name failslab, interval 1, probability 0, space 0, times 0 [ 269.080357][ T6684] CPU: 0 PID: 6684 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 269.089037][ T6684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 269.099207][ T6684] Call Trace: [ 269.102470][ T6684] dump_stack_lvl+0xd6/0x122 [ 269.107181][ T6684] dump_stack+0x11/0x1b [ 269.111444][ T6684] should_fail+0x23c/0x250 [ 269.115852][ T6684] __should_failslab+0x81/0x90 [ 269.120698][ T6684] ? io_drain_req+0x30c/0x610 [ 269.125397][ T6684] should_failslab+0x5/0x20 [ 269.129904][ T6684] kmem_cache_alloc_trace+0x52/0x320 [ 269.135182][ T6684] io_drain_req+0x30c/0x610 [ 269.139721][ T6684] io_submit_sqe+0x357e/0x3eb0 [ 269.144569][ T6684] ? kmem_cache_alloc_bulk+0x289/0x340 [ 269.150012][ T6684] io_submit_sqes+0x505/0xde0 [ 269.154685][ T6684] __se_sys_io_uring_enter+0x20d/0xb30 [ 269.160128][ T6684] ? __fget_light+0x21b/0x260 [ 269.164786][ T6684] ? fput+0x2d/0x130 [ 269.168729][ T6684] __x64_sys_io_uring_enter+0x74/0x80 [ 269.174159][ T6684] do_syscall_64+0x44/0xa0 [ 269.178569][ T6684] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 269.184526][ T6684] RIP: 0033:0x7fc02cad5a39 [ 269.188923][ T6684] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 269.208616][ T6684] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 269.217218][ T6684] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 269.225227][ T6684] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 269.233199][ T6684] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 269.241232][ T6684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 269.249486][ T6684] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:45:59 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 269.773004][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 269.779847][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 269.788164][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:01 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:01 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:01 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:01 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0xff7b0000, 0x0, 0x0, 0x0) 06:46:01 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x2, 0x0, 0x0, 0x0) 06:46:01 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 20) 06:46:01 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 271.612223][ T6719] FAULT_INJECTION: forcing a failure. [ 271.612223][ T6719] name failslab, interval 1, probability 0, space 0, times 0 [ 271.624981][ T6719] CPU: 0 PID: 6719 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 271.633767][ T6719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 271.643822][ T6719] Call Trace: [ 271.647088][ T6719] dump_stack_lvl+0xd6/0x122 [ 271.651853][ T6719] dump_stack+0x11/0x1b [ 271.656009][ T6719] should_fail+0x23c/0x250 [ 271.660409][ T6719] __should_failslab+0x81/0x90 [ 271.665228][ T6719] ? io_drain_req+0x30c/0x610 [ 271.670083][ T6719] should_failslab+0x5/0x20 [ 271.674685][ T6719] kmem_cache_alloc_trace+0x52/0x320 [ 271.679952][ T6719] io_drain_req+0x30c/0x610 [ 271.684462][ T6719] io_submit_sqe+0x357e/0x3eb0 [ 271.689246][ T6719] ? kmem_cache_alloc_bulk+0x289/0x340 [ 271.694773][ T6719] io_submit_sqes+0x505/0xde0 [ 271.699454][ T6719] __se_sys_io_uring_enter+0x20d/0xb30 [ 271.704891][ T6719] ? __fget_light+0x21b/0x260 [ 271.709569][ T6719] ? fput+0x2d/0x130 [ 271.713504][ T6719] __x64_sys_io_uring_enter+0x74/0x80 [ 271.719263][ T6719] do_syscall_64+0x44/0xa0 [ 271.723778][ T6719] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 271.729658][ T6719] RIP: 0033:0x7fc02cad5a39 [ 271.734051][ T6719] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 271.753746][ T6719] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:01 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 271.762241][ T6719] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 271.770400][ T6719] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 271.778496][ T6719] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 271.786527][ T6719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 271.794836][ T6719] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:01 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x2, 0x0, 0x0) 06:46:02 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 21) 06:46:02 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 272.186446][ T6748] FAULT_INJECTION: forcing a failure. [ 272.186446][ T6748] name failslab, interval 1, probability 0, space 0, times 0 [ 272.199147][ T6748] CPU: 0 PID: 6748 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 272.207834][ T6748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 272.217915][ T6748] Call Trace: [ 272.221205][ T6748] dump_stack_lvl+0xd6/0x122 [ 272.225795][ T6748] dump_stack+0x11/0x1b [ 272.229939][ T6748] should_fail+0x23c/0x250 [ 272.234349][ T6748] __should_failslab+0x81/0x90 [ 272.239147][ T6748] ? io_drain_req+0x30c/0x610 [ 272.243806][ T6748] should_failslab+0x5/0x20 [ 272.248294][ T6748] kmem_cache_alloc_trace+0x52/0x320 [ 272.253601][ T6748] io_drain_req+0x30c/0x610 [ 272.258112][ T6748] io_submit_sqe+0x357e/0x3eb0 [ 272.262884][ T6748] ? kmem_cache_alloc_bulk+0x289/0x340 [ 272.268326][ T6748] io_submit_sqes+0x505/0xde0 [ 272.273060][ T6748] __se_sys_io_uring_enter+0x20d/0xb30 [ 272.278500][ T6748] ? __fget_light+0x21b/0x260 [ 272.283213][ T6748] ? fput+0x2d/0x130 [ 272.287101][ T6748] __x64_sys_io_uring_enter+0x74/0x80 [ 272.292563][ T6748] do_syscall_64+0x44/0xa0 [ 272.297067][ T6748] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 272.303000][ T6748] RIP: 0033:0x7fc02cad5a39 [ 272.307399][ T6748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 272.327007][ T6748] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:02 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 272.335417][ T6748] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 272.343566][ T6748] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 272.351613][ T6748] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 272.359584][ T6748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 272.367538][ T6748] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 272.405478][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 272.411602][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 272.420269][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:04 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x6, 0x0, 0x0, 0x0) 06:46:04 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:04 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 22) 06:46:04 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x6, 0x0, 0x0) 06:46:04 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 274.639526][ T6769] FAULT_INJECTION: forcing a failure. [ 274.639526][ T6769] name failslab, interval 1, probability 0, space 0, times 0 [ 274.652332][ T6769] CPU: 1 PID: 6769 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 274.661329][ T6769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 274.671494][ T6769] Call Trace: [ 274.674766][ T6769] dump_stack_lvl+0xd6/0x122 [ 274.679470][ T6769] dump_stack+0x11/0x1b [ 274.683672][ T6769] should_fail+0x23c/0x250 06:46:04 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 274.688122][ T6769] __should_failslab+0x81/0x90 [ 274.692885][ T6769] ? io_drain_req+0x30c/0x610 [ 274.697547][ T6769] should_failslab+0x5/0x20 [ 274.702095][ T6769] kmem_cache_alloc_trace+0x52/0x320 [ 274.707384][ T6769] io_drain_req+0x30c/0x610 [ 274.711873][ T6769] io_submit_sqe+0x357e/0x3eb0 [ 274.716690][ T6769] ? kmem_cache_alloc_bulk+0x289/0x340 [ 274.722170][ T6769] io_submit_sqes+0x505/0xde0 [ 274.726915][ T6769] __se_sys_io_uring_enter+0x20d/0xb30 [ 274.732399][ T6769] ? __fget_light+0x21b/0x260 [ 274.737137][ T6769] ? fput+0x2d/0x130 [ 274.741036][ T6769] __x64_sys_io_uring_enter+0x74/0x80 [ 274.746462][ T6769] do_syscall_64+0x44/0xa0 [ 274.750863][ T6769] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 274.756769][ T6769] RIP: 0033:0x7fc02cad5a39 [ 274.761161][ T6769] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 274.780751][ T6769] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:04 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 23) [ 274.789161][ T6769] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 274.797143][ T6769] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 274.805105][ T6769] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 274.813077][ T6769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 274.821147][ T6769] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 274.903276][ T6784] FAULT_INJECTION: forcing a failure. [ 274.903276][ T6784] name failslab, interval 1, probability 0, space 0, times 0 [ 274.916098][ T6784] CPU: 0 PID: 6784 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 274.924890][ T6784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 274.935077][ T6784] Call Trace: [ 274.938462][ T6784] dump_stack_lvl+0xd6/0x122 [ 274.943047][ T6784] dump_stack+0x11/0x1b [ 274.947269][ T6784] should_fail+0x23c/0x250 [ 274.951947][ T6784] __should_failslab+0x81/0x90 [ 274.956721][ T6784] ? io_drain_req+0x30c/0x610 [ 274.961486][ T6784] should_failslab+0x5/0x20 [ 274.966086][ T6784] kmem_cache_alloc_trace+0x52/0x320 [ 274.971382][ T6784] io_drain_req+0x30c/0x610 [ 274.975957][ T6784] io_submit_sqe+0x357e/0x3eb0 [ 274.980716][ T6784] io_submit_sqes+0x505/0xde0 [ 274.985399][ T6784] __se_sys_io_uring_enter+0x20d/0xb30 [ 274.990866][ T6784] ? __fget_light+0x21b/0x260 [ 274.995616][ T6784] ? fput+0x2d/0x130 06:46:04 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x7, 0x0, 0x0) [ 274.999497][ T6784] __x64_sys_io_uring_enter+0x74/0x80 [ 275.004901][ T6784] do_syscall_64+0x44/0xa0 [ 275.009340][ T6784] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 275.015291][ T6784] RIP: 0033:0x7fc02cad5a39 [ 275.019698][ T6784] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 275.039655][ T6784] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:04 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:04 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 24) [ 275.048272][ T6784] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 275.056228][ T6784] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 275.064192][ T6784] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 275.072180][ T6784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 275.080136][ T6784] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:05 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 275.211684][ T6793] FAULT_INJECTION: forcing a failure. [ 275.211684][ T6793] name failslab, interval 1, probability 0, space 0, times 0 [ 275.224375][ T6793] CPU: 1 PID: 6793 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 275.233086][ T6793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 275.243132][ T6793] Call Trace: [ 275.246498][ T6793] dump_stack_lvl+0xd6/0x122 [ 275.251130][ T6793] dump_stack+0x11/0x1b [ 275.255270][ T6793] should_fail+0x23c/0x250 [ 275.259697][ T6793] __should_failslab+0x81/0x90 [ 275.264533][ T6793] ? io_drain_req+0x30c/0x610 [ 275.269236][ T6793] should_failslab+0x5/0x20 [ 275.273882][ T6793] kmem_cache_alloc_trace+0x52/0x320 [ 275.279190][ T6793] io_drain_req+0x30c/0x610 [ 275.283698][ T6793] io_submit_sqe+0x357e/0x3eb0 [ 275.288703][ T6793] ? kmem_cache_alloc_bulk+0x289/0x340 [ 275.294238][ T6793] io_submit_sqes+0x505/0xde0 [ 275.298912][ T6793] __se_sys_io_uring_enter+0x20d/0xb30 [ 275.304362][ T6793] ? __fget_light+0x21b/0x260 [ 275.309054][ T6793] ? fput+0x2d/0x130 [ 275.312942][ T6793] __x64_sys_io_uring_enter+0x74/0x80 [ 275.318305][ T6793] do_syscall_64+0x44/0xa0 [ 275.322754][ T6793] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 275.328629][ T6793] RIP: 0033:0x7fc02cad5a39 [ 275.333023][ T6793] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 275.352623][ T6793] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 275.361080][ T6793] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 275.369031][ T6793] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 275.376983][ T6793] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 275.384960][ T6793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 275.392915][ T6793] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:05 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x7, 0x0, 0x0, 0x0) [ 275.502551][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 275.508137][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 275.516102][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:07 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 25) 06:46:07 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0xf, 0x0, 0x0) 06:46:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 277.660682][ T6815] FAULT_INJECTION: forcing a failure. [ 277.660682][ T6815] name failslab, interval 1, probability 0, space 0, times 0 [ 277.673492][ T6815] CPU: 1 PID: 6815 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 277.682182][ T6815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 277.692260][ T6815] Call Trace: [ 277.695538][ T6815] dump_stack_lvl+0xd6/0x122 [ 277.700127][ T6815] dump_stack+0x11/0x1b [ 277.704343][ T6815] should_fail+0x23c/0x250 [ 277.708762][ T6815] __should_failslab+0x81/0x90 [ 277.713539][ T6815] ? io_drain_req+0x30c/0x610 [ 277.718277][ T6815] should_failslab+0x5/0x20 [ 277.722759][ T6815] kmem_cache_alloc_trace+0x52/0x320 [ 277.728055][ T6815] io_drain_req+0x30c/0x610 [ 277.732659][ T6815] io_submit_sqe+0x357e/0x3eb0 [ 277.737403][ T6815] ? kmem_cache_alloc_bulk+0x289/0x340 [ 277.743007][ T6815] io_submit_sqes+0x505/0xde0 [ 277.747766][ T6815] __se_sys_io_uring_enter+0x20d/0xb30 [ 277.753202][ T6815] ? __fget_light+0x21b/0x260 [ 277.757873][ T6815] ? fput+0x2d/0x130 [ 277.761834][ T6815] __x64_sys_io_uring_enter+0x74/0x80 [ 277.767272][ T6815] do_syscall_64+0x44/0xa0 [ 277.771673][ T6815] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 277.777550][ T6815] RIP: 0033:0x7fc02cad5a39 [ 277.781956][ T6815] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 277.801695][ T6815] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 277.810087][ T6815] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 277.818047][ T6815] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 277.826010][ T6815] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 277.833975][ T6815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 277.841925][ T6815] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:08 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0xf, 0x0, 0x0, 0x0) 06:46:08 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 278.517342][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 278.522923][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 278.530901][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 279.709707][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 279.715348][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 279.723563][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:10 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 26) 06:46:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x600, 0x0, 0x0) 06:46:10 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x600, 0x0, 0x0, 0x0) 06:46:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, 0x0, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 280.711834][ T6855] FAULT_INJECTION: forcing a failure. [ 280.711834][ T6855] name failslab, interval 1, probability 0, space 0, times 0 [ 280.724482][ T6855] CPU: 1 PID: 6855 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 280.733137][ T6855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 280.743351][ T6855] Call Trace: [ 280.746611][ T6855] dump_stack_lvl+0xd6/0x122 [ 280.751184][ T6855] dump_stack+0x11/0x1b [ 280.755315][ T6855] should_fail+0x23c/0x250 [ 280.759718][ T6855] __should_failslab+0x81/0x90 [ 280.764460][ T6855] ? io_drain_req+0x30c/0x610 [ 280.769216][ T6855] should_failslab+0x5/0x20 [ 280.773695][ T6855] kmem_cache_alloc_trace+0x52/0x320 [ 280.778957][ T6855] io_drain_req+0x30c/0x610 [ 280.783528][ T6855] io_submit_sqe+0x357e/0x3eb0 [ 280.788271][ T6855] ? kmem_cache_alloc_bulk+0x289/0x340 [ 280.793817][ T6855] io_submit_sqes+0x505/0xde0 [ 280.798493][ T6855] __se_sys_io_uring_enter+0x20d/0xb30 [ 280.803985][ T6855] ? __fget_light+0x21b/0x260 [ 280.808658][ T6855] ? fput+0x2d/0x130 [ 280.812546][ T6855] __x64_sys_io_uring_enter+0x74/0x80 [ 280.817994][ T6855] do_syscall_64+0x44/0xa0 [ 280.822410][ T6855] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 280.828296][ T6855] RIP: 0033:0x7fc02cad5a39 [ 280.832689][ T6855] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 280.852272][ T6855] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340), &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:10 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 280.860662][ T6855] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 280.868612][ T6855] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 280.876616][ T6855] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 280.884570][ T6855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 280.892538][ T6855] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 281.549277][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 281.554853][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 281.562941][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:13 executing program 1: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:13 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 27) 06:46:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:13 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:13 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x700, 0x0, 0x0) 06:46:13 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x700, 0x0, 0x0, 0x0) [ 283.724420][ T6893] ================================================================== [ 283.732511][ T6893] BUG: KCSAN: data-race in __io_cqring_fill_event / io_drain_req [ 283.740298][ T6893] [ 283.742606][ T6893] write to 0xffff88812ea25c00 of 4 bytes by task 6896 on cpu 0: [ 283.750215][ T6893] __io_cqring_fill_event+0xfb/0x350 [ 283.755587][ T6893] io_req_complete_post+0x4d/0x640 [ 283.760699][ T6893] io_issue_sqe+0x6145/0x67b0 [ 283.765371][ T6893] io_wq_submit_work+0xf5/0x2c0 [ 283.770205][ T6893] io_worker_handle_work+0x788/0xa20 [ 283.775470][ T6893] io_wqe_worker+0x1b9/0x540 [ 283.780065][ T6893] ret_from_fork+0x1f/0x30 [ 283.784461][ T6893] [ 283.786764][ T6893] read to 0xffff88812ea25c00 of 4 bytes by task 6893 on cpu 1: [ 283.794283][ T6893] io_drain_req+0x4c1/0x610 [ 283.798771][ T6893] io_submit_sqe+0x357e/0x3eb0 [ 283.803518][ T6893] io_submit_sqes+0x505/0xde0 [ 283.808226][ T6893] __se_sys_io_uring_enter+0x20d/0xb30 [ 283.813689][ T6893] __x64_sys_io_uring_enter+0x74/0x80 [ 283.819052][ T6893] do_syscall_64+0x44/0xa0 [ 283.823541][ T6893] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 283.829428][ T6893] [ 283.831730][ T6893] value changed: 0x00000000 -> 0x00000001 [ 283.837466][ T6893] [ 283.839772][ T6893] Reported by Kernel Concurrency Sanitizer on: [ 283.846014][ T6893] CPU: 1 PID: 6893 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 283.854863][ T6893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 283.864900][ T6893] ================================================================== [ 283.873168][ T6893] FAULT_INJECTION: forcing a failure. [ 283.873168][ T6893] name failslab, interval 1, probability 0, space 0, times 0 [ 283.885803][ T6893] CPU: 1 PID: 6893 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 283.894709][ T6893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 283.904744][ T6893] Call Trace: [ 283.908084][ T6893] dump_stack_lvl+0xd6/0x122 [ 283.912699][ T6893] dump_stack+0x11/0x1b [ 283.916838][ T6893] should_fail+0x23c/0x250 [ 283.921379][ T6893] __should_failslab+0x81/0x90 [ 283.926229][ T6893] ? io_drain_req+0x30c/0x610 [ 283.930888][ T6893] should_failslab+0x5/0x20 [ 283.935392][ T6893] kmem_cache_alloc_trace+0x52/0x320 [ 283.940666][ T6893] io_drain_req+0x30c/0x610 [ 283.945246][ T6893] io_submit_sqe+0x357e/0x3eb0 [ 283.950001][ T6893] ? kmem_cache_alloc_bulk+0x289/0x340 [ 283.955441][ T6893] io_submit_sqes+0x505/0xde0 [ 283.960113][ T6893] __se_sys_io_uring_enter+0x20d/0xb30 [ 283.965563][ T6893] ? fpregs_restore_userregs+0x10c/0x1c0 [ 283.971174][ T6893] __x64_sys_io_uring_enter+0x74/0x80 [ 283.976546][ T6893] do_syscall_64+0x44/0xa0 [ 283.980989][ T6893] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 283.986910][ T6893] RIP: 0033:0x7fc02cad5a39 [ 283.991300][ T6893] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 284.010892][ T6893] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:13 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:13 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 28) [ 284.019293][ T6893] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 284.027268][ T6893] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 284.035222][ T6893] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 284.043181][ T6893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 284.051143][ T6893] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:13 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0xf00, 0x0, 0x0) 06:46:14 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:14 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 284.176310][ T6908] FAULT_INJECTION: forcing a failure. [ 284.176310][ T6908] name failslab, interval 1, probability 0, space 0, times 0 [ 284.189153][ T6908] CPU: 1 PID: 6908 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 284.197820][ T6908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 284.207970][ T6908] Call Trace: [ 284.211240][ T6908] dump_stack_lvl+0xd6/0x122 [ 284.215880][ T6908] dump_stack+0x11/0x1b [ 284.220032][ T6908] should_fail+0x23c/0x250 [ 284.224574][ T6908] __should_failslab+0x81/0x90 [ 284.229375][ T6908] should_failslab+0x5/0x20 [ 284.233864][ T6908] kmem_cache_alloc_bulk+0x40/0x340 [ 284.239108][ T6908] io_submit_sqes+0x548/0xde0 [ 284.243894][ T6908] __se_sys_io_uring_enter+0x20d/0xb30 [ 284.249346][ T6908] ? __fget_light+0x21b/0x260 [ 284.254009][ T6908] ? fput+0x2d/0x130 [ 284.257895][ T6908] __x64_sys_io_uring_enter+0x74/0x80 [ 284.263262][ T6908] do_syscall_64+0x44/0xa0 [ 284.267676][ T6908] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 284.273569][ T6908] RIP: 0033:0x7fc02cad5a39 [ 284.277995][ T6908] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 284.297591][ T6908] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 284.306006][ T6908] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 284.314060][ T6908] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 284.322039][ T6908] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 284.330048][ T6908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 284.337999][ T6908] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 284.357285][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 284.366107][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 284.374613][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:16 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 29) 06:46:16 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0xf00, 0x0, 0x0, 0x0) 06:46:16 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r3, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r4}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:16 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:16 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x2000, 0x0, 0x0) 06:46:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 286.731584][ T6930] FAULT_INJECTION: forcing a failure. [ 286.731584][ T6930] name failslab, interval 1, probability 0, space 0, times 0 [ 286.744280][ T6930] CPU: 1 PID: 6930 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 286.753064][ T6930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 286.763170][ T6930] Call Trace: [ 286.766463][ T6930] dump_stack_lvl+0xd6/0x122 [ 286.771057][ T6930] dump_stack+0x11/0x1b [ 286.775265][ T6930] should_fail+0x23c/0x250 [ 286.779685][ T6930] __should_failslab+0x81/0x90 [ 286.784580][ T6930] ? io_drain_req+0x30c/0x610 [ 286.789240][ T6930] should_failslab+0x5/0x20 [ 286.793725][ T6930] kmem_cache_alloc_trace+0x52/0x320 [ 286.799011][ T6930] io_drain_req+0x30c/0x610 [ 286.803513][ T6930] io_submit_sqe+0x357e/0x3eb0 [ 286.808255][ T6930] ? kmem_cache_alloc_bulk+0x289/0x340 [ 286.813701][ T6930] io_submit_sqes+0x505/0xde0 [ 286.818363][ T6930] __se_sys_io_uring_enter+0x20d/0xb30 [ 286.823826][ T6930] ? __fget_light+0x21b/0x260 [ 286.828527][ T6930] ? fput+0x2d/0x130 [ 286.832501][ T6930] __x64_sys_io_uring_enter+0x74/0x80 [ 286.837873][ T6930] do_syscall_64+0x44/0xa0 [ 286.842305][ T6930] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 286.848414][ T6930] RIP: 0033:0x7fc02cad5a39 [ 286.852866][ T6930] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 286.872796][ T6930] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, 0x0, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:16 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:16 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 30) [ 286.881216][ T6930] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 286.889253][ T6930] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 286.897210][ T6930] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 286.905363][ T6930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 286.913429][ T6930] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:16 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x7bff, 0x0, 0x0) 06:46:16 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 287.055558][ T6943] FAULT_INJECTION: forcing a failure. [ 287.055558][ T6943] name failslab, interval 1, probability 0, space 0, times 0 [ 287.068223][ T6943] CPU: 1 PID: 6943 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 287.076889][ T6943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 287.086940][ T6943] Call Trace: [ 287.090265][ T6943] dump_stack_lvl+0xd6/0x122 [ 287.094851][ T6943] dump_stack+0x11/0x1b [ 287.099005][ T6943] should_fail+0x23c/0x250 [ 287.103420][ T6943] __should_failslab+0x81/0x90 [ 287.108170][ T6943] ? io_drain_req+0x30c/0x610 [ 287.112835][ T6943] should_failslab+0x5/0x20 [ 287.117315][ T6943] kmem_cache_alloc_trace+0x52/0x320 [ 287.122665][ T6943] io_drain_req+0x30c/0x610 [ 287.127147][ T6943] io_submit_sqe+0x357e/0x3eb0 [ 287.131977][ T6943] ? kmem_cache_alloc_bulk+0x289/0x340 [ 287.137414][ T6943] io_submit_sqes+0x505/0xde0 [ 287.142149][ T6943] __se_sys_io_uring_enter+0x20d/0xb30 [ 287.147607][ T6943] ? __fget_light+0x21b/0x260 [ 287.152263][ T6943] ? fput+0x2d/0x130 [ 287.156155][ T6943] __x64_sys_io_uring_enter+0x74/0x80 [ 287.161506][ T6943] do_syscall_64+0x44/0xa0 [ 287.165917][ T6943] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 287.171853][ T6943] RIP: 0033:0x7fc02cad5a39 [ 287.176329][ T6943] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 287.196090][ T6943] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 287.204500][ T6943] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 287.212550][ T6943] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 287.220500][ T6943] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 287.228543][ T6943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 287.236520][ T6943] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:17 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x2000, 0x0, 0x0, 0x0) [ 287.449470][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 287.455005][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 287.462866][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:17 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r3, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r4}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:17 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 31) 06:46:17 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:17 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0xff7b, 0x0, 0x0) [ 287.632541][ T6966] FAULT_INJECTION: forcing a failure. [ 287.632541][ T6966] name failslab, interval 1, probability 0, space 0, times 0 [ 287.645240][ T6966] CPU: 1 PID: 6966 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 287.653911][ T6966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 287.663943][ T6966] Call Trace: [ 287.667204][ T6966] dump_stack_lvl+0xd6/0x122 [ 287.671855][ T6966] dump_stack+0x11/0x1b [ 287.676030][ T6966] should_fail+0x23c/0x250 [ 287.680421][ T6966] __should_failslab+0x81/0x90 [ 287.685321][ T6966] ? io_drain_req+0x30c/0x610 [ 287.690042][ T6966] should_failslab+0x5/0x20 [ 287.694637][ T6966] kmem_cache_alloc_trace+0x52/0x320 [ 287.699901][ T6966] io_drain_req+0x30c/0x610 [ 287.704456][ T6966] io_submit_sqe+0x357e/0x3eb0 [ 287.709201][ T6966] ? kmem_cache_alloc_bulk+0x289/0x340 [ 287.714656][ T6966] io_submit_sqes+0x505/0xde0 [ 287.719336][ T6966] __se_sys_io_uring_enter+0x20d/0xb30 [ 287.724856][ T6966] ? __fget_light+0x21b/0x260 06:46:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:17 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 287.729535][ T6966] ? fput+0x2d/0x130 [ 287.733433][ T6966] __x64_sys_io_uring_enter+0x74/0x80 [ 287.738807][ T6966] do_syscall_64+0x44/0xa0 [ 287.743374][ T6966] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 287.749276][ T6966] RIP: 0033:0x7fc02cad5a39 [ 287.753709][ T6966] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 287.773315][ T6966] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 287.781715][ T6966] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 287.789701][ T6966] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 287.797651][ T6966] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 287.805615][ T6966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 287.813562][ T6966] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:17 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:17 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x7bff, 0x0, 0x0, 0x0) 06:46:17 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 32) [ 287.914672][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 287.921477][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 287.929895][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 288.024235][ T7001] FAULT_INJECTION: forcing a failure. [ 288.024235][ T7001] name failslab, interval 1, probability 0, space 0, times 0 [ 288.036964][ T7001] CPU: 0 PID: 7001 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 288.045643][ T7001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 288.055678][ T7001] Call Trace: [ 288.058945][ T7001] dump_stack_lvl+0xd6/0x122 [ 288.063585][ T7001] dump_stack+0x11/0x1b [ 288.067800][ T7001] should_fail+0x23c/0x250 [ 288.072203][ T7001] __should_failslab+0x81/0x90 [ 288.077044][ T7001] ? io_drain_req+0x30c/0x610 [ 288.081703][ T7001] should_failslab+0x5/0x20 [ 288.086192][ T7001] kmem_cache_alloc_trace+0x52/0x320 [ 288.091457][ T7001] io_drain_req+0x30c/0x610 [ 288.096202][ T7001] io_submit_sqe+0x357e/0x3eb0 [ 288.100966][ T7001] ? kmem_cache_alloc_bulk+0x289/0x340 [ 288.106485][ T7001] io_submit_sqes+0x505/0xde0 [ 288.111147][ T7001] __se_sys_io_uring_enter+0x20d/0xb30 [ 288.116624][ T7001] ? __fget_light+0x21b/0x260 [ 288.121299][ T7001] ? fput+0x2d/0x130 [ 288.125187][ T7001] __x64_sys_io_uring_enter+0x74/0x80 [ 288.130556][ T7001] do_syscall_64+0x44/0xa0 [ 288.134958][ T7001] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 288.141015][ T7001] RIP: 0033:0x7fc02cad5a39 [ 288.145496][ T7001] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 288.165083][ T7001] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 288.173547][ T7001] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 288.181511][ T7001] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 288.189475][ T7001] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 288.197441][ T7001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 288.205415][ T7001] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:18 executing program 1: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r2, r1, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r3, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r4}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:18 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x1000000, 0x0, 0x0) 06:46:18 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:18 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 33) [ 288.469899][ T7012] FAULT_INJECTION: forcing a failure. [ 288.469899][ T7012] name failslab, interval 1, probability 0, space 0, times 0 [ 288.482567][ T7012] CPU: 0 PID: 7012 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 288.491322][ T7012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 288.501370][ T7012] Call Trace: [ 288.504643][ T7012] dump_stack_lvl+0xd6/0x122 [ 288.509220][ T7012] dump_stack+0x11/0x1b [ 288.513373][ T7012] should_fail+0x23c/0x250 06:46:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:18 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 288.517797][ T7012] __should_failslab+0x81/0x90 [ 288.522606][ T7012] ? io_drain_req+0x30c/0x610 [ 288.527380][ T7012] should_failslab+0x5/0x20 [ 288.531879][ T7012] kmem_cache_alloc_trace+0x52/0x320 [ 288.537145][ T7012] io_drain_req+0x30c/0x610 [ 288.541720][ T7012] io_submit_sqe+0x357e/0x3eb0 [ 288.546476][ T7012] ? kmem_cache_alloc_bulk+0x289/0x340 [ 288.551916][ T7012] io_submit_sqes+0x505/0xde0 [ 288.556575][ T7012] __se_sys_io_uring_enter+0x20d/0xb30 [ 288.562033][ T7012] ? __fget_light+0x21b/0x260 [ 288.566693][ T7012] ? fput+0x2d/0x130 [ 288.570605][ T7012] __x64_sys_io_uring_enter+0x74/0x80 [ 288.576138][ T7012] do_syscall_64+0x44/0xa0 [ 288.580686][ T7012] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 288.586582][ T7012] RIP: 0033:0x7fc02cad5a39 [ 288.590976][ T7012] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 288.610561][ T7012] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:18 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 34) [ 288.618962][ T7012] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 288.626914][ T7012] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 288.634877][ T7012] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 288.642830][ T7012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 288.650949][ T7012] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 288.765913][ T7034] FAULT_INJECTION: forcing a failure. [ 288.765913][ T7034] name failslab, interval 1, probability 0, space 0, times 0 [ 288.778569][ T7034] CPU: 1 PID: 7034 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 288.787240][ T7034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 288.797288][ T7034] Call Trace: [ 288.800553][ T7034] dump_stack_lvl+0xd6/0x122 [ 288.805122][ T7034] dump_stack+0x11/0x1b [ 288.809254][ T7034] should_fail+0x23c/0x250 [ 288.813648][ T7034] __should_failslab+0x81/0x90 [ 288.818480][ T7034] ? io_drain_req+0x30c/0x610 [ 288.823160][ T7034] should_failslab+0x5/0x20 [ 288.827661][ T7034] kmem_cache_alloc_trace+0x52/0x320 [ 288.832925][ T7034] io_drain_req+0x30c/0x610 [ 288.837416][ T7034] io_submit_sqe+0x357e/0x3eb0 [ 288.842168][ T7034] ? kmem_cache_alloc_bulk+0x289/0x340 [ 288.847620][ T7034] io_submit_sqes+0x505/0xde0 [ 288.852275][ T7034] __se_sys_io_uring_enter+0x20d/0xb30 [ 288.857727][ T7034] ? __fget_light+0x21b/0x260 [ 288.862490][ T7034] ? fput+0x2d/0x130 [ 288.866362][ T7034] __x64_sys_io_uring_enter+0x74/0x80 [ 288.871798][ T7034] do_syscall_64+0x44/0xa0 [ 288.876212][ T7034] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 288.882145][ T7034] RIP: 0033:0x7fc02cad5a39 [ 288.886552][ T7034] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 288.906137][ T7034] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 288.914521][ T7034] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 288.922510][ T7034] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 288.930457][ T7034] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 288.938402][ T7034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 288.946367][ T7034] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:18 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0xff7b, 0x0, 0x0, 0x0) 06:46:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:18 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 289.011268][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 289.027306][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 289.035571][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 289.188392][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 289.194083][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 289.202480][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:19 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 35) 06:46:19 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x2000000, 0x0, 0x0) 06:46:19 executing program 1: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x20000, 0x0, 0x0, 0x0) 06:46:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 289.336529][ T7063] FAULT_INJECTION: forcing a failure. [ 289.336529][ T7063] name failslab, interval 1, probability 0, space 0, times 0 [ 289.349156][ T7063] CPU: 0 PID: 7063 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 289.357808][ T7063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 289.367906][ T7063] Call Trace: [ 289.371177][ T7063] dump_stack_lvl+0xd6/0x122 [ 289.375893][ T7063] dump_stack+0x11/0x1b [ 289.380044][ T7063] should_fail+0x23c/0x250 [ 289.384511][ T7063] __should_failslab+0x81/0x90 [ 289.389263][ T7063] ? io_drain_req+0x30c/0x610 [ 289.394012][ T7063] should_failslab+0x5/0x20 [ 289.398512][ T7063] kmem_cache_alloc_trace+0x52/0x320 [ 289.403784][ T7063] io_drain_req+0x30c/0x610 [ 289.408318][ T7063] io_submit_sqe+0x357e/0x3eb0 [ 289.413080][ T7063] ? kmem_cache_alloc_bulk+0x289/0x340 [ 289.418559][ T7063] io_submit_sqes+0x505/0xde0 [ 289.423238][ T7063] __se_sys_io_uring_enter+0x20d/0xb30 [ 289.428740][ T7063] ? __fget_light+0x21b/0x260 06:46:19 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x6000000, 0x0, 0x0) [ 289.433461][ T7063] ? fput+0x2d/0x130 [ 289.437336][ T7063] __x64_sys_io_uring_enter+0x74/0x80 [ 289.442720][ T7063] do_syscall_64+0x44/0xa0 [ 289.447191][ T7063] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 289.453062][ T7063] RIP: 0033:0x7fc02cad5a39 [ 289.457479][ T7063] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 289.477067][ T7063] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 36) [ 289.485490][ T7063] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 289.493538][ T7063] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 289.501516][ T7063] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 289.509518][ T7063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 289.517554][ T7063] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 289.610610][ T7084] FAULT_INJECTION: forcing a failure. [ 289.610610][ T7084] name failslab, interval 1, probability 0, space 0, times 0 [ 289.623353][ T7084] CPU: 1 PID: 7084 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 289.632007][ T7084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 289.642035][ T7084] Call Trace: [ 289.645294][ T7084] dump_stack_lvl+0xd6/0x122 [ 289.649893][ T7084] dump_stack+0x11/0x1b [ 289.654038][ T7084] should_fail+0x23c/0x250 [ 289.658458][ T7084] __should_failslab+0x81/0x90 [ 289.663207][ T7084] ? io_drain_req+0x30c/0x610 [ 289.668063][ T7084] should_failslab+0x5/0x20 [ 289.672549][ T7084] kmem_cache_alloc_trace+0x52/0x320 [ 289.677810][ T7084] io_drain_req+0x30c/0x610 [ 289.682298][ T7084] io_submit_sqe+0x357e/0x3eb0 [ 289.687047][ T7084] ? kmem_cache_alloc_bulk+0x289/0x340 [ 289.692489][ T7084] io_submit_sqes+0x505/0xde0 [ 289.697147][ T7084] __se_sys_io_uring_enter+0x20d/0xb30 [ 289.702622][ T7084] ? __fget_light+0x21b/0x260 [ 289.707299][ T7084] ? fput+0x2d/0x130 [ 289.711181][ T7084] __x64_sys_io_uring_enter+0x74/0x80 [ 289.716534][ T7084] do_syscall_64+0x44/0xa0 [ 289.720935][ T7084] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 289.726834][ T7084] RIP: 0033:0x7fc02cad5a39 [ 289.731308][ T7084] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 289.750900][ T7084] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:19 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x7000000, 0x0, 0x0) 06:46:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 289.759324][ T7084] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 289.767296][ T7084] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 289.775246][ T7084] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 289.783208][ T7084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 289.791153][ T7084] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:19 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 37) [ 289.946306][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 289.951899][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 289.960371][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated [ 289.964885][ T7100] FAULT_INJECTION: forcing a failure. [ 289.964885][ T7100] name failslab, interval 1, probability 0, space 0, times 0 [ 289.980141][ T7100] CPU: 1 PID: 7100 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 289.988806][ T7100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 289.998861][ T7100] Call Trace: [ 290.002138][ T7100] dump_stack_lvl+0xd6/0x122 [ 290.006797][ T7100] dump_stack+0x11/0x1b [ 290.010997][ T7100] should_fail+0x23c/0x250 [ 290.015435][ T7100] __should_failslab+0x81/0x90 [ 290.020206][ T7100] should_failslab+0x5/0x20 [ 290.024716][ T7100] kmem_cache_alloc_bulk+0x40/0x340 [ 290.029975][ T7100] io_submit_sqes+0x548/0xde0 [ 290.034650][ T7100] __se_sys_io_uring_enter+0x20d/0xb30 [ 290.040115][ T7100] ? __fget_light+0x21b/0x260 [ 290.044775][ T7100] ? fput+0x2d/0x130 [ 290.048646][ T7100] __x64_sys_io_uring_enter+0x74/0x80 [ 290.054024][ T7100] do_syscall_64+0x44/0xa0 [ 290.058433][ T7100] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 290.064304][ T7100] RIP: 0033:0x7fc02cad5a39 [ 290.068695][ T7100] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 290.088367][ T7100] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:19 executing program 1: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:19 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x1000000, 0x0, 0x0, 0x0) 06:46:20 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 38) [ 290.096849][ T7100] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 290.104813][ T7100] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 290.112843][ T7100] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 290.121160][ T7100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 290.129128][ T7100] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:20 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0xf000000, 0x0, 0x0) 06:46:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 290.242688][ T7113] FAULT_INJECTION: forcing a failure. [ 290.242688][ T7113] name failslab, interval 1, probability 0, space 0, times 0 [ 290.255349][ T7113] CPU: 0 PID: 7113 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 290.264023][ T7113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 290.274057][ T7113] Call Trace: [ 290.277328][ T7113] dump_stack_lvl+0xd6/0x122 [ 290.281935][ T7113] dump_stack+0x11/0x1b [ 290.286068][ T7113] should_fail+0x23c/0x250 [ 290.290514][ T7113] __should_failslab+0x81/0x90 [ 290.295257][ T7113] ? io_drain_req+0x30c/0x610 [ 290.299940][ T7113] should_failslab+0x5/0x20 [ 290.304445][ T7113] kmem_cache_alloc_trace+0x52/0x320 [ 290.309740][ T7113] io_drain_req+0x30c/0x610 [ 290.314233][ T7113] io_submit_sqe+0x357e/0x3eb0 [ 290.319014][ T7113] ? kmem_cache_alloc_bulk+0x289/0x340 [ 290.324458][ T7113] io_submit_sqes+0x505/0xde0 [ 290.329185][ T7113] __se_sys_io_uring_enter+0x20d/0xb30 [ 290.334729][ T7113] ? __fget_light+0x21b/0x260 [ 290.339406][ T7113] ? fput+0x2d/0x130 06:46:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 290.343303][ T7113] __x64_sys_io_uring_enter+0x74/0x80 [ 290.348676][ T7113] do_syscall_64+0x44/0xa0 [ 290.353074][ T7113] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 290.358962][ T7113] RIP: 0033:0x7fc02cad5a39 [ 290.363365][ T7113] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 290.382970][ T7113] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:20 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 39) 06:46:20 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x20000000, 0x0, 0x0) [ 290.391372][ T7113] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 290.399323][ T7113] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 290.407272][ T7113] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 290.415377][ T7113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 290.423355][ T7113] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r4, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r5}}, 0x81) io_uring_enter(0xffffffffffffffff, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:20 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 290.514809][ T7134] FAULT_INJECTION: forcing a failure. [ 290.514809][ T7134] name failslab, interval 1, probability 0, space 0, times 0 [ 290.527557][ T7134] CPU: 0 PID: 7134 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 290.536276][ T7134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 290.546331][ T7134] Call Trace: [ 290.549624][ T7134] dump_stack_lvl+0xd6/0x122 [ 290.554218][ T7134] dump_stack+0x11/0x1b [ 290.558372][ T7134] should_fail+0x23c/0x250 [ 290.562859][ T7134] __should_failslab+0x81/0x90 [ 290.567644][ T7134] ? io_drain_req+0x30c/0x610 [ 290.572302][ T7134] should_failslab+0x5/0x20 [ 290.576791][ T7134] kmem_cache_alloc_trace+0x52/0x320 [ 290.582162][ T7134] io_drain_req+0x30c/0x610 [ 290.586719][ T7134] io_submit_sqe+0x357e/0x3eb0 [ 290.591465][ T7134] ? kmem_cache_alloc_bulk+0x289/0x340 [ 290.596906][ T7134] io_submit_sqes+0x505/0xde0 [ 290.601571][ T7134] __se_sys_io_uring_enter+0x20d/0xb30 [ 290.607016][ T7134] ? __fget_light+0x21b/0x260 [ 290.611764][ T7134] ? fput+0x2d/0x130 [ 290.615655][ T7134] __x64_sys_io_uring_enter+0x74/0x80 [ 290.621011][ T7134] do_syscall_64+0x44/0xa0 [ 290.625412][ T7134] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 290.631307][ T7134] RIP: 0033:0x7fc02cad5a39 [ 290.635705][ T7134] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 290.655842][ T7134] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 290.664305][ T7134] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 290.672340][ T7134] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 290.680291][ T7134] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 290.688246][ T7134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 290.696198][ T7134] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 [ 290.720509][ T379] loop2: p1 < > p2 p3 < p5 p6 > p4 [ 290.726159][ T379] loop2: p2 size 1073741824 extends beyond EOD, truncated [ 290.734024][ T379] loop2: p5 size 1073741824 extends beyond EOD, truncated 06:46:20 executing program 1: r0 = syz_io_uring_setup(0x0, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, r4, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r7}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:20 executing program 2: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x2000000, 0x0, 0x0, 0x0) 06:46:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:46:20 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 40) 06:46:20 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) 06:46:20 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 291.062333][ T7153] FAULT_INJECTION: forcing a failure. [ 291.062333][ T7153] name failslab, interval 1, probability 0, space 0, times 0 [ 291.075110][ T7153] CPU: 0 PID: 7153 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 291.083784][ T7153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 291.093832][ T7153] Call Trace: [ 291.097090][ T7153] dump_stack_lvl+0xd6/0x122 [ 291.101683][ T7153] dump_stack+0x11/0x1b [ 291.105847][ T7153] should_fail+0x23c/0x250 [ 291.110340][ T7153] __should_failslab+0x81/0x90 [ 291.115099][ T7153] ? io_drain_req+0x30c/0x610 [ 291.119844][ T7153] should_failslab+0x5/0x20 [ 291.124403][ T7153] kmem_cache_alloc_trace+0x52/0x320 [ 291.129676][ T7153] io_drain_req+0x30c/0x610 [ 291.134202][ T7153] io_submit_sqe+0x357e/0x3eb0 [ 291.138986][ T7153] ? kmem_cache_alloc_bulk+0x289/0x340 [ 291.144519][ T7153] io_submit_sqes+0x505/0xde0 [ 291.149228][ T7153] __se_sys_io_uring_enter+0x20d/0xb30 [ 291.154735][ T7153] ? __fget_light+0x21b/0x260 06:46:21 executing program 4: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd=r5, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x45f5, 0x0, 0xff7b0000, 0x0, 0x0) [ 291.159396][ T7153] ? fput+0x2d/0x130 [ 291.163285][ T7153] __x64_sys_io_uring_enter+0x74/0x80 [ 291.168637][ T7153] do_syscall_64+0x44/0xa0 [ 291.173073][ T7153] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 291.178975][ T7153] RIP: 0033:0x7fc02cad5a39 [ 291.183365][ T7153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 291.202973][ T7153] RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa 06:46:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:46:21 executing program 3: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE, 0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000600)={0xffffffffffffffff}) tee(r5, 0xffffffffffffffff, 0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r6, 0x0, {}, 0x0, 0x0, 0x0, {0x0, 0x0, r7}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) (fail_nth: 41) 06:46:21 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 291.211386][ T7153] RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39 [ 291.219336][ T7153] RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003 [ 291.227297][ T7153] RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000 [ 291.235277][ T7153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 291.243304][ T7153] R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000 06:46:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x81) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 06:46:21 executing program 0: r0 = syz_io_uring_setup(0x183, &(0x7f00000002c0), &(0x7f0000148000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, 0x0, 0x0, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r5, 0x0, {}, 0x80000000, 0x0, 0x0, {0x0, 0x0, r6}}, 0x0) io_uring_enter(r0, 0x45f5, 0x0, 0x0, 0x0, 0x0) [ 291.358032][ T7170] FAULT_INJECTION: forcing a failure. [ 291.358032][ T7170] name failslab, interval 1, probability 0, space 0, times 0 [ 291.370666][ T7170] CPU: 0 PID: 7170 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0 [ 291.379362][ T7170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 291.389446][ T7170] Call Trace: [ 291.392706][ T7170] dump_stack_lvl