last executing test programs: 3.076408438s ago: executing program 5 (id=290): mknod(&(0x7f0000000140)='./file0\x00', 0x2000, 0x4287e) r0 = open(&(0x7f0000000080)='./file0\x00', 0x2, 0x0) r1 = getppid() fcntl$setown(r0, 0x6, r1) fcntl$setown(r0, 0x6, 0x0) 2.76283854s ago: executing program 5 (id=316): r0 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$diskmap(0xffffffffffffff9c, 0x0, 0x80, 0x0) openat$pf(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$DIOCGETSTATE(0xffffffffffffffff, 0xc1084413, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$WSKBDIO_SETMODE(r0, 0x80045713, &(0x7f0000000240)=0x1) 1.660772545s ago: executing program 5 (id=321): r0 = openat$dri(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card0\x00', 0x100, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r0, 0xc01864c2, 0x0) readv(0xffffffffffffffff, &(0x7f0000000980)=[{&(0x7f00000006c0)=""/219, 0xdb}], 0x1) r1 = socket$inet(0x18, 0x3, 0x102) sendmsg(r1, &(0x7f0000000240)={&(0x7f0000000280)=@in6={0x1c, 0x18, 0x0, 0x7, '\x00', 0x101}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000180)="638802000000339afe51f6f2efa24a85abdd612dd68e59adfecf9323100084410a8591426ee03e", 0x27}, {&(0x7f0000000680)="a2", 0xfdac}], 0x2, 0x0}, 0x402) 1.530733186s ago: executing program 5 (id=331): ppoll(0x0, 0x0, 0x0, 0x0) 1.463847564s ago: executing program 6 (id=333): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7fb, 0x6, 0x3, 0xfe, 0x4, 0x5, 0x4, 0x10, [{0x3, 0x2, 0x6, 0x71800}, {0x3, 0xb7fe, 0x800002}, {0x100006, 0x0, 0x208, 0x2}, {0x2, 0x80ff, 0x200, 0xfffffffb}, {0x10000, 0x3, 0x80000001, 0x7}, {0x2, 0x7f, 0x14000009, 0xf}, {0x1, 0xbffffff9, 0x1, 0x6d}, {0x2400a, 0x3, 0xfdf0, 0x4}, {0x0, 0x6, 0x3, 0x9}, {0x401, 0x0, 0x8001, 0x7}, {0x800a44f, 0xfff9, 0x48a, 0x13}, {0xcb, 0x2, 0x8, 0x8}, {0x2000df, 0x29, 0x5, 0x3ff}, {0x8, 0xfffffffc, 0xfffffff6, 0xffffffb8}, {0x6, 0x5, 0x26, 0x3}, {0xfffffffd, 0xd654, 0x3, 0x6}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) r1 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r1, 0x8080691a, &(0x7f0000000100)) 1.43164683s ago: executing program 6 (id=341): r0 = open(&(0x7f0000000040)='./file0\x00', 0x615, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x11, r0, 0x0) ftruncate(r0, 0x8531) mlock(&(0x7f0000000000/0x2000)=nil, 0x2000) open$dir(&(0x7f0000001100)='./file0\x00', 0x1, 0x2) msync(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4) 1.370277616s ago: executing program 4 (id=345): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(0x0, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(r1, 0xffffffffffffffff, r3) 1.312507036s ago: executing program 4 (id=350): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f00000000c0)={0x1e, 0x3ff, 0x6dca0653, 0x160310a, "04f00400000004be1fa614e0ff22700907ffdd00", 0x80000003, 0x43}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 972.321069ms ago: executing program 6 (id=358): sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404, &(0x7f0000000000)={0x10, 0x2, 0x1, 0xe0000001}, 0x10) r0 = socket(0x2, 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)="6dc100167f", 0x5}], 0x1) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) connect$unix(r0, &(0x7f0000000000), 0x10) getpeername$inet6(r0, 0x0, &(0x7f0000000080)) 970.09676ms ago: executing program 2 (id=360): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000200)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x0, 0x2, 0x1, 0x9}, {0x6, 0xd, 0x9, 0x1000}]}) sysctl$kern(0x0, 0x0, &(0x7f0000000240)="c2a6500034dd7fb55c3f1f17dd129377bad7eb54398a124acb56265c2e122966288200019324b9b7a0536259", &(0x7f0000000000)=0x2c, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000040)={0x28, 0x0}) write(r0, &(0x7f00000002c0)="f81ad30100060000000100000000", 0xe) 934.645549ms ago: executing program 6 (id=361): open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7ffbf, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, 0x0, 0x0) sysctl$net_inet_tcp(&(0x7f0000000040)={0x4, 0x2, 0x6, 0x12}, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) recvmmsg(r1, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 0x0}, 0xfe}, 0x38, 0x3042, 0x0) 867.229353ms ago: executing program 6 (id=363): ioctl$WSMOUSEIO_GETPARAMS(0xffffffffffffffff, 0x80105727, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x80206979, 0x0) setgid(0xffffffffffffffff) r0 = msgget$private(0x0, 0x0) setresgid(0x0, 0x0, 0x0) setuid(0xffffffffffffffff) msgctl$IPC_STAT(r0, 0x2, 0x0) 866.456084ms ago: executing program 2 (id=366): r0 = socket(0x18, 0x1, 0x0) close(r0) setuid(0xee01) r1 = socket(0x18, 0x1, 0x0) setsockopt(r1, 0x29, 0xe, &(0x7f0000000000)="02000000", 0x4) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x18, 0x3, 0x3, "fe8234022c23bdd0e86bc2a6b5ae30dd", 0x3}, 0x1c) 850.976253ms ago: executing program 2 (id=368): select(0x40, &(0x7f0000000140)={0x8, 0x803, 0xffffffffffffffff, 0x2, 0x4, 0x1, 0x7fffffffffffffff, 0x6}, 0x0, 0x0, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) r1 = socket(0x18, 0x3, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) ioctl$FIONREAD(r1, 0x8080691a, &(0x7f0000000100)) 769.256263ms ago: executing program 2 (id=375): r0 = socket$inet6(0x18, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1000, &(0x7f0000000140)=0x5, 0x4) bind$inet6(r0, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000010000000600", 0x7}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x18, 0x2, 0x9, "000000000006000000000900f100", 0x3c6}, 0x1c) r1 = socket(0x2, 0x8002, 0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) closefrom(r2) 742.772037ms ago: executing program 2 (id=378): syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2000, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x1, 0x2, 0x8}}}}}}) syz_emit_ethernet(0x5a, &(0x7f0000000000)={@local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x2000, 0x0, 0x70, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x1, 0x2, 0x8}, {"b76bf11d5d4ff88eab4e7d94dcf5288151f250627b0e1fb09303834ed31912d28c8b0c85e066cffa0341de445bbf0423"}}}}}}) setresuid(0x0, 0xee00, 0x0) r0 = msgget$private(0x0, 0x1ba) msgctl$IPC_SET(r0, 0x1, &(0x7f0000000400)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1ff}, 0x0, 0x0, 0xb24, 0x1, 0x3, 0x0, 0x0, 0x6, 0x0, 0x40, 0x0, 0x7}) msgctl$IPC_STAT(r0, 0x2, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@random="b905f0ffffff", @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x0, 0x1, 0x8}}}}}}) r1 = semget(0x0, 0x0, 0x1d8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) setresgid(0x0, r4, 0x0) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000780)={{0x0, 0x0, r3, r4, 0x8f, 0x9, 0x0, 0x0, 0x4}, 0x0, 0x6, 0x0, 0x0, 0x6, 0x0, 0x8}) seteuid(r3) r5 = socket(0x18, 0x1, 0x0) fcntl$setown(r5, 0x6, 0x0) ktrace(&(0x7f00000000c0)='./file0\x00', 0x1, 0x820, 0x0) setresuid(0x0, 0xee00, 0x0) setresuid(0xee00, 0xee00, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) madvise(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) 742.079227ms ago: executing program 4 (id=379): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x3, 0x3, 0x1, 0xa}, {0x1c, 0xc9, 0xfe, 0x7}, {0x9b1e, 0x2, 0xf, 0x40203fd}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x1000e, &(0x7f00000015c0)=ANY=[]) 739.446701ms ago: executing program 7 (id=380): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x2, 0xff, 0x1, 0x9}, {0x30, 0xc9, 0x2, 0x8}, {0x9b1e, 0x22, 0xf, 0x40207ff}]}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0xa4, 0x5, 0x0, 0x56}, {0x48, 0x26, 0x6, 0x7fc1}]}) semop(0x0, &(0x7f0000000000)=[{0x0, 0xfff8, 0x800}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0xe3, &(0x7f0000000480)=ANY=[]) 739.102945ms ago: executing program 3 (id=381): setrlimit(0x8, &(0x7f0000000980)={0x7, 0x4b}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$FIOASYNC(r0, 0x80047469, &(0x7f00000000c0)=0x47) write(r0, 0x0, 0x0) writev(r0, &(0x7f0000000040)=[{0x0, 0x24}], 0x1) read(r1, &(0x7f0000001640)=""/225, 0xe1) 709.875313ms ago: executing program 0 (id=382): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() openat$speaker(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) close(r0) mknod(&(0x7f0000000080)='./bus\x00', 0x2000, 0x6d4) r1 = open(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) ioctl$FIOASYNC(r1, 0x80047470, &(0x7f00000000c0)=0x5) ioctl$FIOASYNC(r0, 0x80047466, &(0x7f0000000200)=0x5) 709.154345ms ago: executing program 1 (id=383): openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x7, 0x7, 0x1, 0x8}, {0x44, 0x7, 0xfe, 0x8}, {0x9b1e, 0x22, 0xf, 0x4}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000040)={0x28, 0x0}) write(r0, &(0x7f00000002c0)="f81ad30100060000000100000000", 0xe) 656.591649ms ago: executing program 4 (id=384): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x10686, 0x8) sendmsg$unix(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000000000)="bf3b684c5a", 0x5}], 0x1}, 0x1) r1 = syz_open_pts() ktrace(&(0x7f0000000100)='./file0\x00', 0x4, 0xd27d43220c7ff9d, 0x0) readv(r1, &(0x7f0000000600), 0x10000000000002a5) closefrom(r0) 656.314703ms ago: executing program 6 (id=385): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x801, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) r0 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, r3, 0x0) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000780)={{0x0, 0x0, r2, r3, 0x8f, 0x23, 0x0, 0x0, 0x3ff}, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x5}) setgroups(0x0, 0x0) setuid(0xee01) r4 = semget(0x0, 0x1, 0x281) semop(r4, &(0x7f0000000000)=[{0x0, 0xfff8, 0x1000}], 0x1) semop(0x0, &(0x7f00000000c0)=[{0x0, 0xb, 0x1800}], 0x1) 656.117156ms ago: executing program 7 (id=386): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x3, 0x3, 0x1, 0xa}, {0x1c, 0xc9, 0xfe, 0x7}, {0x9b1e, 0x2, 0xf, 0x40203fd}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x0, 0x0}) sysctl$kern(0x0, 0x0, &(0x7f0000000180)="c2a6500034dd7fb55c3f1f17dd129377ba8200019324b9b7a0536259f563790a", &(0x7f0000000000)=0x20, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x1000e, &(0x7f00000015c0)=ANY=[]) 655.607595ms ago: executing program 0 (id=387): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) r0 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$DIOCMAP(r0, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r0, 0x7}) ioctl$FIOASYNC(0xffffffffffffffff, 0x80047460, &(0x7f00000000c0)=0x4) sysctl$hw(&(0x7f0000000280)={0x6, 0x8}, 0x2, &(0x7f0000000000)="0000e65bc39e76ecc9ddb3c3cc6bbc2506870300ec", &(0x7f0000000240)=0x15, 0x0, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) execve(0x0, 0x0, 0x0) pwrite(r0, &(0x7f00000001c0)="8c4709", 0x3, 0x9) 655.196602ms ago: executing program 1 (id=388): setrlimit(0x8, &(0x7f0000000980)={0x7, 0x4b}) r0 = syz_open_pts() close(r0) socket(0x2, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000000000000000000000000001", 0x7}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = socket(0x18, 0x3, 0x0) connect$inet6(r1, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x1, "fe800004008b5d00f3c666e38b00fdff", 0x8b}, 0x1c) write(r0, 0x0, 0x0) 654.81743ms ago: executing program 2 (id=389): r0 = semget(0x0, 0x1, 0x281) semop(r0, &(0x7f0000000000)=[{0x0, 0xfff8, 0x1000}], 0x1) 627.431072ms ago: executing program 3 (id=390): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() sysctl$kern(&(0x7f0000000000)={0x1, 0x45}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) setsid() ioctl$TIOCSCTTY(r1, 0x20007461) ioctl$TIOCSETD(r0, 0x8004745f, &(0x7f0000000000)=0x1d) 626.663409ms ago: executing program 5 (id=391): r0 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) setresgid(0x0, r3, 0x0) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000780)={{0x0, 0x0, r2, r3, 0x8f, 0x23, 0x0, 0x0, 0x3ff}, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x5}) setgroups(0x0, 0x0) setuid(0xee01) semget(0x0, 0x0, 0x1d8) 534.958433ms ago: executing program 4 (id=392): r0 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000780)={{0x0, r3, r2, r3, 0x8f, 0x9, 0x0, 0x0, 0xfffffffffffffffb}, 0x0, 0x6, 0x0, 0x0, 0x6, 0x0, 0x8}) setgroups(0x0, 0x0) setresgid(r3, r3, 0x0) setuid(0xffffffffffffffff) semctl$SETVAL(r0, 0x0, 0x8, 0x0) 516.727621ms ago: executing program 7 (id=393): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f0000000340)={0x6, 0x8, 0x5, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x8}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000240)=""/1, 0x1}], 0x1) 516.094321ms ago: executing program 4 (id=394): mknod(&(0x7f00000002c0)='./bus\x00', 0x2000, 0x5200) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x2000, 0x4800) ppoll(0x0, 0x0, 0x0, 0x0) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000000c0)={0x10, 0x4, [{&(0x7f0000558000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil}, {&(0x7f0000340000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0xffffbfffffffff7e}, {&(0x7f0000ffd000/0x1000)=nil, &(0x7f00006b9000/0x1000)=nil, 0x80000000}, {&(0x7f00001da000/0x4000)=nil, &(0x7f00000d6000/0x1000)=nil, 0xffffffffffffffff}, {&(0x7f000024d000/0x1000)=nil, &(0x7f00005ff000/0x4000)=nil, 0x401}, {&(0x7f00000e0000/0x2000)=nil, &(0x7f0000179000/0x1000)=nil, 0x80000002}, {&(0x7f0000338000/0x4000)=nil, &(0x7f0000000000/0x400000)=nil, 0x8}, {&(0x7f000077c000/0x1000)=nil, &(0x7f00000ce000/0x4000)=nil, 0x7}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x6b9}, {&(0x7f0000132000/0x2000)=nil, &(0x7f00003f2000/0x2000)=nil, 0xa}, {&(0x7f000064b000/0x2000)=nil, &(0x7f000038f000/0x4000)=nil, 0x12b}, {&(0x7f0000008000/0x3000)=nil, &(0x7f0000688000/0x4000)=nil, 0x2}, {&(0x7f0000196000/0x3000)=nil, &(0x7f000076c000/0x4000)=nil, 0xa}, {&(0x7f000024b000/0x2000)=nil, &(0x7f000079e000/0x4000)=nil, 0xffffffffbffffff9}, {&(0x7f00004d0000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x5e04}, {&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000001000/0x800000)=nil, 0x6}], './file0\x00', 0x3, 0xfffffffd, 0x0, 0x18000000, [0x0, 0x3, 0x0, 0x62, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b3, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff6a7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x7e, 0x0) sysctl$net_inet_tcp(&(0x7f0000000000)={0x4, 0x2, 0x6, 0x13}, 0x4, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSETA(r0, 0xcd60441a, &(0x7f0000000040)={0x1, 0x2, 0x7, 0x2f, "2000030100010000000000000068a95a010400", 0x6, 0x2}) ioctl$DIOCRCLRTSTATS(r0, 0xc4504441, &(0x7f0000002080)={{'./bus\x00', './file0\x00', 0x10, 0x9}, &(0x7f0000000b80)=[{'./bus\x00', './bus\x00', 0x0, 0x1}, {'./file0\x00', './bus\x00', 0x41, 0xe}, {'./bus\x00', './bus\x00', 0x42, 0x9}], 0x3, 0x3, 0x0, 0xb, 0x7fffffff, 0x36, 0x0, 0x9}) ioctl$FIOASYNC(0xffffffffffffffff, 0xc0107002, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chmod(&(0x7f0000000280)='./file0\x00', 0x3a) chmod(&(0x7f0000000040)='.\x00', 0x35e) r1 = shmget$private(0x0, 0x4000, 0x1a2, &(0x7f000010f000/0x4000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f00000000c0)=""/212) 515.625102ms ago: executing program 1 (id=395): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) syz_open_pts() mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f00000000c0)={0x7f0, 0x1, 0x583, 0x800000, "cc14ee112100caa26a364fa8a325850d1ec100", 0x7ffd, 0xe}) writev(r0, &(0x7f0000000580)=[{&(0x7f00000009c0)="8d1292c41a5273b7b90aa2ca9ca5a66aa30bc95524ea7da6c696ff6c105ea53c2fb92308d939191824f30203413a2d260040966bb560e874ba513105498b7f7df121fc27dbf5feb72b939ea3f7b5f45ad027c0e4a5d7305ed13a46d8463e11e51df09a18317c22730e80145d935ff906e707e089aa8ed823aaac3d540ca457aa5418686ae7a57a314326b974a8c271ec9b9714be216ae8e69b6ec2f7df03d1bd2b9ca95c1ff1271d3857832021744251faf55ca1e19a2de863b73120393489590d9653f0139f9072b5b5e54d8b1a61aec41577878ed6791d6aee7851ff90e106061139c47a96f9ec17f4421b298d5452bcff7a23c8e1433305d6aa6750848663434ff6379c686d48d991cfbdbff3a669092c16e000b9c07ec66fd53088db7b899a131493815a82ef4b338c9cb2daa9ccbc80b0f94756a80700e82b112c895cf802e10bd7cddf0283a8699d89b8b37f84becec1a719359f99b8ee2747ee7842ed5db130fa14c1cb81e01db80c65", 0x16d}], 0x1) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 397.936367ms ago: executing program 3 (id=396): mknodat(0xffffffffffffff9c, 0x0, 0xc0e99db6de761f86, 0x0) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x8, 0x2, 0x1, 0x8}, {0x1c, 0xc9, 0xff, 0x6}, {0x9b1e, 0x22, 0xf, 0x40203ff}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x0, &(0x7f0000000080)}) sysctl$kern(0x0, 0x0, &(0x7f0000000180)="c2a6500034dd7fb55c3f1f17dd129377966083c8c7", &(0x7f0000000000)=0x15, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x1000e, &(0x7f0000000080)=ANY=[]) 397.502955ms ago: executing program 3 (id=397): r0 = shmget$private(0x0, 0x2000, 0x88, &(0x7f0000001000/0x2000)=nil) shmat(r0, &(0x7f0000001000/0x3000)=nil, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r1, 0x80104267, &(0x7f0000000180)={0x4, &(0x7f0000000080)=[{0x80, 0x7, 0x1, 0x9}, {0x80, 0x8, 0xf7, 0x3f9}, {0x1, 0x1, 0x9, 0x9}, {0x9b1e, 0xd, 0xf4, 0x4000800}]}) syz_emit_ethernet(0x46, 0x0) openat(0xffffffffffffffff, 0x0, 0x80, 0x101) syz_emit_ethernet(0x1000e, &(0x7f00000001c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x67, 0x0, 0x0, 0x11, 0x0, @broadcast, @local={0xac, 0x14, 0x0}}, @icmp=@dest_unreach={0x3, 0x4, 0x0, 0x0, 0x8, 0x0, {0x5, 0x4, 0x2, 0x1d, 0x4, 0x66, 0xecf, 0x4, 0x3b, 0x5, @multicast1, @multicast1}}}}}}) 397.257617ms ago: executing program 3 (id=398): r0 = open(&(0x7f0000000480)='./file0\x00', 0x1, 0xd6) ioctl$VMM_IOC_RESETCPU(r0, 0x82405605, &(0x7f00000004c0)={0x2, 0x5, {[0xfffffffffffffff9, 0x3, 0x7, 0x0, 0x400, 0x3, 0x1, 0x9, 0x3, 0x9, 0x4, 0x3ff, 0x1, 0x2, 0x7, 0x7ff, 0x5, 0xda], [0x6, 0x5, 0x0, 0x1, 0x8, 0x3, 0xef36, 0x2, 0x115, 0x2], [0x2, 0xa2ac, 0x8, 0x86, 0x7ff, 0x10, 0x2], [0x101, 0x80, 0x7, 0x2, 0xfffffffffffffff3, 0xd4a1], [{0x5, 0x3, 0x7f, 0xffffffffffffffff}, {0x0, 0x800, 0x1, 0x8}, {0xe7, 0x7, 0x7, 0x2}, {0x7, 0xb0, 0x2}, {0xc, 0x4, 0x0, 0xc}, {0x0, 0x1, 0x4, 0x80000000}, {0x1, 0x5, 0x3, 0x5}, {0x0, 0xfffffff0, 0x3, 0xb}], {0x8, 0x6, 0x9, 0x3}, {0xfff9, 0x7, 0xfffff8cd, 0x1}}}) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000280)='#!', 0x10}, {&(0x7f0000000000)="8d6bb85551ec8430877ae32fe9bbe42cc8f2147a3eba8e1969f0435119cf4c071c8aee7ef2921be5d7d4796c5566c95989acb3d185587234186e96b8fde9ffac51de05a87b8b893e2abd154dd886eafbe03881d25b7b13b4c32227fc9e5a86a06f59f701322b3a109a13436e486b0a", 0x6f}], 0x2) ioctl$DIOCGETSYNFLWATS(0xffffffffffffffff, 0xc0084463, &(0x7f0000000040)) ioctl$TIOCSETA(0xffffffffffffffff, 0xcd60441a, &(0x7f0000000080)={0x4, 0x2, 0x9, 0x14d, "2000030100010000000000000068a95a010400", 0x6, 0x2}) readv(0xffffffffffffffff, 0x0, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$TIOCSETA(r1, 0xcd604406, &(0x7f0000000040)={0x7ffb, 0x0, 0xfffbfff0, 0x0, "d6a24900b178926c79486b47c1dd00", 0x4, 0x5}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCSETA(r1, 0xcd604407, &(0x7f0000000040)={0xa, 0x2000000, 0x2, 0x800005, "2c0d000000024000a400000300", 0x4, 0x8}) 396.928506ms ago: executing program 3 (id=399): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) r2 = syz_open_pts() setsid() syz_open_pts() ioctl$TIOCSCTTY(r2, 0x20007461) openat$tty(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) dup3(r1, r0, 0x0) 172.998556ms ago: executing program 1 (id=400): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x1, 0x1, 0x0) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) r1 = socket(0x18, 0x3, 0xfd) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) r2 = socket(0x18, 0x3, 0x50) r3 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x40) pwritev(r2, &(0x7f0000001540), 0x0, 0x8001) ioctl$DIOCSETSTATUSIF(r3, 0xc0284414, &(0x7f0000000140)={'./file0\x00', 0x0, 0x10000, 0x3, 0xb5, 0x8}) socket(0x18, 0x2, 0x0) ioctl$FIONREAD(r1, 0x8080691a, &(0x7f0000000100)) 171.57053ms ago: executing program 7 (id=401): mknod(0x0, 0x2000, 0x285b9a) r0 = open(0x0, 0x800, 0x120) kevent(r0, 0x0, 0xffeffff1, 0x0, 0xb19, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$FIONBIO(r0, 0x82907003, 0x0) mknod(0x0, 0x2000, 0x5c4a) setuid(0xee01) utimensat(0xffffffffffffff9c, 0x0, 0x0, 0x2) ioctl$WSMOUSEIO_GTYPE(0xffffffffffffffff, 0x80047476, 0x0) r1 = semget(0x0, 0x1, 0x281) syz_emit_ethernet(0x3a, 0x0) semctl$GETVAL(r1, 0x0, 0x5, 0x0) 169.924269ms ago: executing program 1 (id=402): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x2000, 0x4800) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000000c0)={0x10, 0x4, [{&(0x7f0000558000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil}, {&(0x7f0000340000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0xffffffffffffff7e}, {&(0x7f0000ffd000/0x1000)=nil, &(0x7f00006b9000/0x1000)=nil, 0x80000000}, {&(0x7f00001da000/0x4000)=nil, &(0x7f00000d6000/0x1000)=nil, 0xffffffffffffffff}, {&(0x7f000024d000/0x1000)=nil, &(0x7f00005ff000/0x4000)=nil, 0x401}, {&(0x7f000060b000/0x2000)=nil, &(0x7f0000179000/0x1000)=nil, 0x80000002}, {&(0x7f0000338000/0x4000)=nil, &(0x7f0000000000/0x400000)=nil, 0x8}, {&(0x7f000077c000/0x1000)=nil, &(0x7f00000ce000/0x4000)=nil, 0x7}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x6b9}, {&(0x7f0000132000/0x2000)=nil, &(0x7f00003f2000/0x2000)=nil, 0xa}, {&(0x7f000064b000/0x2000)=nil, &(0x7f000038f000/0x4000)=nil, 0x12b}, {&(0x7f0000008000/0x3000)=nil, &(0x7f0000688000/0x4000)=nil, 0x2}, {&(0x7f0000196000/0x3000)=nil, &(0x7f000076c000/0x4000)=nil, 0xa}, {&(0x7f000024b000/0x2000)=nil, &(0x7f000079e000/0x4000)=nil, 0xffffffffbffffff9}, {&(0x7f00004d0000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x5e04}, {&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000001000/0x800000)=nil, 0x6}], './file0\x00', 0x3, 0x0, 0x0, 0x18000000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b3, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd50, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000]}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x7e, 0x0) ioctl$TIOCSETA(r0, 0xcd60441a, &(0x7f0000000040)={0x1, 0x2, 0x7, 0x2f, "2000030100010000000000000068a95a010400", 0x6, 0x2}) r1 = openat$wsmouse(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$WSMOUSEIO_SETPARAMS(r1, 0x80105728, &(0x7f0000000080)={0x0}) ioctl$DIOCRCLRTSTATS(r0, 0xc4504441, &(0x7f0000002080)={{'./file0\x00', './file0\x00', 0x10, 0x9}, &(0x7f0000000b80)=[{'./bus\x00', './bus\x00', 0x0, 0x1}, {'./file0\x00', './file0\x00', 0x41, 0xe}, {'./bus\x00', './file0\x00', 0x42, 0x9}, {'./file0\x00', './file0\x00', 0x4, 0x85}], 0x3, 0x4, 0x0, 0xf, 0x101, 0x36, 0x0, 0x9}) r2 = kqueue() kevent(r2, &(0x7f0000000380)=[{{}, 0xfffffffffffffff9, 0xc1, 0x1, 0xfffffffffffffff8, 0x1}], 0x4, 0x0, 0x8, 0x0) ioctl$FIOASYNC(0xffffffffffffffff, 0xc0107002, &(0x7f00000000c0)) 169.174911ms ago: executing program 0 (id=403): ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) socket(0x1, 0x1000, 0x9) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0xb, 0x3, 0x101, 0x4, 0x1, 0x3, 0x10, [{0x5, 0xde3, 0xffffff26, 0x71800}, {0xfffffffd, 0x300b7fe, 0x800002, 0x7}, {0x1, 0x0, 0x0, 0x2}, {0x2, 0x0, 0x200, 0xfffffffc}, {0x4, 0x4, 0x80000000, 0x20007}, {0x2, 0x47fff, 0x14000009, 0xc}, {0x70, 0xbffffff5, 0x5, 0x6d}, {0x2000a, 0x4, 0xfdf1, 0x9}, {0x0, 0x7, 0x1510, 0xa}, {0xfffffc04, 0x4, 0x8003, 0x10000}, {0xa44f, 0xfff6, 0xa38c000, 0xe1}, {0x80000cb, 0x40, 0x8001, 0x4}, {0x2000df, 0x5, 0x15, 0x400}, {0x6, 0xe2, 0xfffffff5, 0x2}, {0x5, 0x5, 0x24, 0x6}, {0x4, 0xd655, 0x3, 0x6}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x2, 0x800c1, 0xf, 0x0, 0x1040807, 0x50001, 0x0, 0x1, 0x0, 0x8, 0xf5fffffffffffff9}) socket(0x18, 0x3, 0x0) r1 = socket(0x18, 0x3, 0x0) setitimer(0x1, &(0x7f0000000140)={{0x4, 0x100900000000009}, {0xdffffffffffffcff, 0x7fff}}, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) ioctl$FIONREAD(r1, 0x8080691a, &(0x7f0000000100)) 127.323419ms ago: executing program 5 (id=404): r0 = socket$unix(0x1, 0x1, 0x0) bind(r0, 0x0, 0x0) ioctl$BIOCLOCK(0xffffffffffffffff, 0x20004276) ioctl$BIOCGSTATS(0xffffffffffffffff, 0x4008426f, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000040)={0x0, 0x7, 0xff7f8002, 0x57272a54, 0x2, [], [0x9, 0x80000001, 0x7], [0x8001, 0x4, 0x2, 0x9], [0x4, 0x7, 0x98]}) r1 = msgget$private(0x0, 0xa8) msgsnd(r1, &(0x7f0000000040)=ANY=[], 0x401, 0x0) msgsnd(r1, 0x0, 0x401, 0x0) execve(0x0, 0x0, 0x0) 126.929913ms ago: executing program 1 (id=405): r0 = socket(0x2, 0x8002, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) r1 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$DIOCMAP(r1, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r1, 0x3}) ioctl$FIOASYNC(0xffffffffffffffff, 0x80047460, &(0x7f00000000c0)=0x4) sysctl$hw(&(0x7f0000000280)={0x6, 0x8}, 0x2, &(0x7f0000000000)="0000e65bc39e76ecc9ddb3c3cc6bbc2506870300ec", &(0x7f0000000240)=0x15, 0x0, 0x0) execve(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) read(r1, &(0x7f0000000300)=""/162, 0xa2) r2 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) closefrom(r2) 126.593105ms ago: executing program 7 (id=406): syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2000, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x1, 0x2, 0x8}}}}}}) syz_emit_ethernet(0x5a, &(0x7f0000000000)={@local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x2000, 0x0, 0x70, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x1, 0x2, 0x8}, {"b76bf11d5d4ff88eab4e7d94dcf5288151f250627b0e1fb09303834ed31912d28c8b0c85e066cffa0341de445bbf0423"}}}}}}) setresuid(0x0, 0xee00, 0x0) r0 = msgget$private(0x0, 0x1ba) msgctl$IPC_SET(r0, 0x1, &(0x7f0000000400)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1ff}, 0x0, 0x0, 0xb24, 0x1, 0x3, 0x0, 0x0, 0x6, 0x0, 0x40, 0x0, 0x7}) msgctl$IPC_STAT(r0, 0x2, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@random="b905f0ffffff", @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x0, 0x1, 0x8}}}}}}) r1 = semget(0x0, 0x0, 0x1d8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) setresgid(0x0, r4, 0x0) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000780)={{0x0, 0x0, r3, r4, 0x8f, 0x9, 0x0, 0x0, 0x4}, 0x0, 0x6, 0x0, 0x0, 0x6, 0x0, 0x8}) seteuid(r3) r5 = socket(0x18, 0x1, 0x0) fcntl$setown(r5, 0x6, 0x0) ktrace(&(0x7f00000000c0)='./file0\x00', 0x1, 0x820, 0x0) setresuid(0x0, 0xee00, 0x0) setresuid(0xee00, 0xee00, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) madvise(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) 126.007675ms ago: executing program 0 (id=407): sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001800)=ANY=[@ANYBLOB='2%'], 0x20, 0xe}, 0x2) open$dir(&(0x7f0000000300)='.\x00', 0x8, 0x4a) sysctl$net_inet6_icmp6(&(0x7f0000000000)={0x4, 0x18, 0x3a, 0x3}, 0x4, 0x0, 0x0, 0x0, 0x0) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x200000000000) setgid(0xffffffffffffffff) setgroups(0x0, 0x0) kill(0xffffffffffffffff, 0x6) getgroups(0x0, 0x0) r0 = openat$klog(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) readv(r0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/29, 0x1d}], 0x1) setuid(0xffffffffffffffff) unveil(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='r\x00') 70.55947ms ago: executing program 0 (id=408): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000200)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x9, 0x3, 0x1, 0x8}, {0x20, 0x9, 0xfe, 0xc}, {0x9b1e, 0x22, 0xf, 0x4}]}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000000)={0x0, &(0x7f0000000080)}) sysctl$kern(0x0, 0x0, &(0x7f0000000240)="c2a6500034dd7fb55c3f1f17dd129377bad7eb54398a124acb56265c2e122966288200019324b9b7a0536259", &(0x7f0000000000)=0x2c, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000040)={0x28, 0x0}) write(r0, &(0x7f00000002c0)="f81ad30100060000000100000000", 0xe) 70.032762ms ago: executing program 7 (id=409): setrlimit(0x8, &(0x7f00000000c0)={0x45, 0x56}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$FIOASYNC(r0, 0x80047466, &(0x7f0000000200)=0x5) socket(0x1, 0x2, 0x0) pselect(0x40, &(0x7f00000038c0)={0x6, 0x8, 0x8, 0x800, 0x7, 0x5, 0x8, 0x7}, 0x0, &(0x7f0000003940)={0x7af, 0x8, 0x2, 0x1, 0x2, 0x6, 0xe09d, 0xa}, 0x0, 0x0) 0s ago: executing program 0 (id=410): r0 = socket(0x18, 0x1, 0x0) getsockopt(r0, 0x29, 0x33, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.174' (ED25519) to the list of known hosts. pckbd_enable: command error pppx: unable to set addresses for pppx1, error=17 Connection to 10.128.0.174 closed by remote host. ¹j¼õ¬|ÿ ž¨E1\…:pckbd_enable: command error OpenBSD/amd64 (ci-openbsd-multicore-0.us-central1-c.c.syzkaller.internal) (tty00) login: init: getty repeating too quickly on port /dev/tty00, sleeping panic: ip6_getpcbopt: unexpected option Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 75831 4179 0 0 0 0 syz-executor *207656 4179 0 0 0x4000000 1 syz-executor db_enter() at db_enter+0x25 panic(ffffffff83521df8) at panic+0x1e5 ip6_getpcbopt(0,33,fffffc806b117b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff800010fdd4a8,29,33,fffffc806b117b00) at ip6_ctloutput+0xfb2 sogetopt(ffff800010fdd4a8,29,33,fffffc806b117b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe9778,ffff80003a3a8890,ffff80003a3a87e0) at sys_getsockopt+0x1ec syscall(ffff80003a3a8890) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xa2d2ec2fd00, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: ip6_getpcbopt: unexpected option ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff83521df8) at panic+0x1e5 ip6_getpcbopt(0,33,fffffc806b117b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff800010fdd4a8,29,33,fffffc806b117b00) at ip6_ctloutput+0xfb2 sogetopt(ffff800010fdd4a8,29,33,fffffc806b117b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe9778,ffff80003a3a8890,ffff80003a3a87e0) at sys_getsockopt+0x1ec syscall(ffff80003a3a8890) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xa2d2ec2fd00, count: -8 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80003a3a84f0 rbx 0xffff80002998ee07 rdx 0xffff8000015dacc0 rcx 0xffff807ffffe9778 rax 0xffff80002998dff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x6d294af45b2619fd r11 0x9fb6719c64fa2b7e r12 0xffff80002998ec08 r13 0 r14 0 r15 0x1 rip 0xffffffff821356f5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003a3a84e0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=207656 pid=4179 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff807ffffe8a80,0xffff807ffffe8030 process=0xffff807ffffec9b8 user=0xffff80003a3a3000, vmspace=0xfffffc806c5277b0 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 77857 341335 42713 0 2 0 syz-executor 4179 75831 69198 0 7 0 syz-executor * 4179 207656 69198 0 7 0x4000000 syz-executor 55480 506960 1 0 3 0x80 nanoslp init 78593 396980 64821 0 3 0x80 nanoslp syz-executor 78593 286038 64821 0 3 0x4000080 msgwait syz-executor 78593 73856 64821 0 3 0x4000080 fsleep syz-executor 20048 420495 92799 0 3 0x81 nanoslp syz-executor 20048 171619 92799 0 3 0x4000081 ttyopn syz-executor 20048 148443 92799 0 3 0x4000081 fsleep syz-executor 39161 202210 76774 0 3 0x80 nanoslp syz-executor 39161 130212 76774 0 3 0x4000080 kqpoll syz-executor 39161 509148 76774 0 3 0x4000080 fsleep syz-executor 94652 161552 79856 0 3 0x80 nanoslp syz-executor 94652 83210 79856 0 3 0x4000080 semwait syz-executor 68511 280134 28172 60929 3 0x90 nanoslp syz-executor 68511 358363 28172 60929 3 0x4000090 semwait syz-executor 68511 465753 28172 60929 3 0x4000090 fsleep syz-executor 42713 189275 50565 0 3 0x82 nanoslp syz-executor 28172 82766 50565 0 3 0x82 nanoslp syz-executor 64821 130389 50565 0 3 0x82 nanoslp syz-executor 76774 499679 50565 0 3 0x82 nanoslp syz-executor 92799 334985 50565 0 3 0x82 nanoslp syz-executor 79856 510211 50565 0 3 0x82 nanoslp syz-executor 56352 485181 50565 0 2 0x2 syz-executor 69198 401856 50565 0 3 0x82 nanoslp syz-executor 50565 342648 1 0 2 0x2 syz-executor 73644 194197 0 0 3 0x14200 bored smr 38778 72408 0 0 3 0x14200 pgzero zerothread 91140 493891 0 0 3 0x14200 aiodoned aiodoned 17261 53279 0 0 3 0x14200 syncer update 85169 339799 0 0 3 0x14200 cleaner cleaner 42281 211403 0 0 3 0x14200 reaper reaper 43038 160893 0 0 3 0x14200 pgdaemon pagedaemon 99402 253386 0 0 3 0x14200 bored viomb 62287 359680 0 0 3 0x40014200 acpi0 acpi0 20960 475620 0 0 3 0x40014200 idle1 32196 202605 0 0 3 0x14200 bored softnet1 42229 376092 0 0 3 0x14200 bored softnet0 74831 56943 0 0 3 0x14200 bored systqmp 51501 212729 0 0 3 0x14200 bored systq 50118 312136 0 0 3 0x14200 tmoslp softclockmp 19888 67960 0 0 3 0x40014200 tmoslp softclock 37218 394926 0 0 3 0x40014200 idle0 1 473266 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks Process 4179 (syz-executor) thread 0xffff807ffffe9778 (207656) exclusive rwlock netlock r = 0 (0xffffffff83974b30) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 sogetopt+0x105 #3 sys_getsockopt+0x1ec #4 syscall+0xbd4 #5 Xsyscall+0x128 Process 56352 (syz-executor) thread 0xffff80002a212010 (485181) exclusive rrwlock inode r = 0 (0xfffffc806a561560) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vget+0x2a2 #6 ufs_ihashget+0x185 #7 ffs_vget+0x8c #8 ufs_lookup+0x1a36 #9 VOP_LOOKUP+0x6e #10 vfs_lookup+0x963 #11 namei+0x7c5 #12 dounlinkat+0xc1 #13 syscall+0xb17 #14 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffc806b3dcc40) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vfs_lookup+0x12b #6 namei+0x7c5 #7 dounlinkat+0xc1 #8 syscall+0xb17 #9 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11049 12080K 12537K 166960K 12540 0 pcb 17 12K 12K 166960K 79 0 rtable 246 10K 10K 166960K 429 0 pf 36 18K 25K 166960K 141 0 ifaddr 40 7K 8K 166960K 63 0 ifgroup 51 2K 2K 166960K 84 0 sysctl 3 1K 9K 166960K 9 0 counters 68 36K 38K 166960K 106 0 ioctlops 0 0K 4K 166960K 1560 0 iov 0 0K 16K 166960K 7 0 mount 1 1K 1K 166960K 1 0 log 1 0K 0K 166960K 5 0 vnodes 1289 81K 82K 166960K 1561 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 7 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 31 0 dirhash 12 2K 2K 166960K 18 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 16 61K 89K 166960K 541 0 sigio 0 0K 0K 166960K 6 0 proc 12 17K 180K 166960K 565 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 16 0 in_multi 92 6K 7K 166960K 132 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 12 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 67 307K 307K 166960K 67 0 exec 0 0K 1K 166960K 418 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 137 78K 176K 166960K 6286 0 UVM aobj 11 2K 4K 166960K 12 0 pinsyscall 18 36K 103K 166960K 1702 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 28 0 NDP 11 0K 2K 166960K 41 0 temp 52 9122K 9164K 166960K 16325 0 kqueue 1 2K 26K 166960K 51 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 39 0 39 1 0 1 1 0 8 1 rtentry 176 129 0 24 6 0 6 6 0 8 1 unpcb 144 153 0 150 1 0 1 1 0 8 0 syncache 336 10 0 10 1 0 1 1 0 8 1 tcpcb 736 79 0 77 1 0 1 1 0 8 0 arp 136 20 0 3 1 0 1 1 0 8 0 ipq 40 1 0 1 1 0 1 1 0 8 1 ipqe 40 3 0 3 1 0 1 1 0 8 1 inpcb 328 267 0 263 2 0 2 2 0 8 1 nd6 152 30 0 6 1 0 1 1 0 8 0 pkpcb 40 2 0 2 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 14 0 14 1 0 1 1 0 8 1 pppxif 1576 3 0 3 1 0 1 1 0 8 1 pfstscr 40 11 0 9 1 0 1 1 0 8 0 pffrag 232 11 0 7 1 0 1 1 0 482 0 pffrnode 88 11 0 7 1 0 1 1 0 8 0 pffrent 40 23 0 19 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfanchor 1288 12 0 10 1 0 1 1 0 8 0 pftag 88 7 0 2 1 0 1 1 0 8 0 pfstitem 24 32 0 2 1 0 1 1 0 8 0 pfstkey 128 40 0 10 2 0 2 2 0 8 1 pfstate 448 34 0 5 4 0 4 4 0 8 0 pfrule 1360 42 0 41 2 1 1 2 0 8 0 rttmr 136 1 0 1 1 0 1 1 0 8 1 art_heap8 4096 2 0 0 2 0 2 2 0 8 0 art_heap4 256 523 0 76 30 0 30 30 0 8 2 art_table 40 525 0 76 5 0 5 5 0 8 0 art_node 32 129 0 34 1 0 1 1 0 8 0 sysvmsgpl 40 5 0 1 1 0 1 1 0 8 0 semupl 112 4 0 4 1 0 1 1 0 8 1 semapl 72 28 0 18 1 0 1 1 0 8 0 shmpl 112 9 0 1 1 0 1 1 0 8 0 dirhash 1024 21 0 4 3 0 3 3 0 8 0 dino2pl 256 2138 0 665 93 0 93 93 0 8 0 ffsino 296 2138 0 665 114 0 114 114 0 8 0 nchpl 144 2789 0 1088 64 0 64 64 0 8 0 rtmask 32 5 0 5 1 0 1 1 0 8 1 vnodes 216 2372 0 0 132 0 132 132 0 8 0 namei 1024 8094 0 8094 2 0 2 2 0 8 2 percpumem 16 68 0 19 1 0 1 1 0 8 0 kstatmem 264 45 0 20 3 0 3 3 0 8 1 scxspl 216 10984 0 10984 4 3 1 3 1 8 1 plimitpl 152 57 0 48 1 0 1 1 0 8 0 sigapl 424 860 0 825 7 0 7 7 0 8 1 knotepl 120 518 0 0 16 0 16 16 0 8 0 kqueuepl 224 72 0 70 1 0 1 1 0 8 0 pipepl 344 131 0 103 3 0 3 3 0 8 0 fdescpl 528 844 0 825 3 0 3 3 0 8 0 filepl 160 2859 0 2699 10 0 10 10 0 8 0 lockfpl 104 165 0 164 1 0 1 1 0 8 0 lockfspl 48 82 0 81 1 0 1 1 0 8 0 sessionpl 144 37 0 34 1 0 1 1 0 8 0 pgrppl 48 47 0 36 1 0 1 1 0 8 0 ucredpl 104 391 0 387 1 0 1 1 0 8 0 zombiepl 144 825 0 825 1 0 1 1 0 8 1 processpl 1232 860 0 825 5 0 5 5 0 8 1 procpl 664 1343 0 1298 6 0 6 6 0 8 1 sosppl 176 9 0 9 1 0 1 1 0 8 1 sockpl 752 464 0 457 4 0 4 4 0 8 2 mcl64k 65536 19 0 0 3 0 3 3 0 8 0 mcl16k 16384 17 0 0 3 0 3 3 0 8 0 mcl12k 12288 13 0 0 2 0 2 2 0 8 0 mcl9k128 9344 5 0 0 1 0 1 1 0 8 0 mcl8k 8192 15 0 0 2 0 2 2 0 8 0 mcl4k 4096 117 0 0 15 0 15 15 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 19 0 0 3 0 3 3 0 8 0 mtagpl 96 5 0 0 1 0 1 1 0 8 0 mbufpl 256 175 0 0 11 0 11 11 0 8 0 bufpl 272 4814 0 106 314 0 314 314 0 8 0 anonpl 32 7615 0 0 62 0 62 62 0 115 0 amapchunkpl 152 19629 0 19205 24 1 23 23 0 158 4 amappl16 200 2622 0 2602 14 4 10 14 0 8 7 amappl15 192 2 0 2 1 1 0 1 0 8 0 amappl14 184 428 0 428 1 0 1 1 0 8 1 amappl13 176 123 0 123 1 0 1 1 0 8 1 amappl12 168 1094 0 1078 2 0 2 2 0 8 0 amappl11 160 36 0 36 1 1 0 1 0 8 0 amappl10 152 62 0 62 1 0 1 1 0 8 1 amappl9 144 277 0 277 1 1 0 1 0 8 0 amappl8 136 99 0 98 1 0 1 1 0 8 0 amappl7 128 149 0 147 1 0 1 1 0 8 0 amappl6 120 231 0 231 1 0 1 1 0 8 1 amappl5 112 95 0 95 1 0 1 1 0 8 1 amappl4 104 296 0 294 1 0 1 1 0 8 0 amappl3 96 4003 0 3924 4 0 4 4 0 8 1 amappl2 88 548 0 543 2 0 2 2 0 8 0 amappl1 80 12301 0 12207 15 1 14 15 0 8 8 amappl 88 5482 0 5355 5 0 5 5 0 92 0 uvmvnodes 80 110 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 11 0 1 1 0 1 1 0 8 0 uaddrrnd 24 844 0 825 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 844 0 825 1 0 1 1 0 8 0 vmmpekpl 168 8072 0 8039 2 0 2 2 0 8 0 vmmpepl 168 60745 0 59935 97 0 97 97 0 357 53 vmsppl 488 843 0 825 5 0 5 5 0 8 2 rwobjpl 80 19048 0 18640 27 0 27 27 0 8 8 pdppl 4096 1695 0 1650 95 48 47 83 0 8 2 pvpl 32 15610 0 0 126 0 126 126 0 265 0 pmappl 256 843 0 825 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 590 0 51 16 0 16 16 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff838d6ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x71c14f3983a0, count: 12 ddb{0}> trace x86_ipi_db(ffffffff838d6ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 end of kernel end trace frame: 0x71c14f3983a0, count: -3 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff83521df8) at panic+0x1e5 ip6_getpcbopt(0,33,fffffc806b117b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff800010fdd4a8,29,33,fffffc806b117b00) at ip6_ctloutput+0xfb2 sogetopt(ffff800010fdd4a8,29,33,fffffc806b117b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe9778,ffff80003a3a8890,ffff80003a3a87e0) at sys_getsockopt+0x1ec syscall(ffff80003a3a8890) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xa2d2ec2fd00, count: 7 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff83521df8) at panic+0x1e5 ip6_getpcbopt(0,33,fffffc806b117b00) at ip6_getpcbopt+0x3e3 ip6_ctloutput(0,ffff800010fdd4a8,29,33,fffffc806b117b00) at ip6_ctloutput+0xfb2 sogetopt(ffff800010fdd4a8,29,33,fffffc806b117b00) at sogetopt+0x128 sys_getsockopt(ffff807ffffe9778,ffff80003a3a8890,ffff80003a3a87e0) at sys_getsockopt+0x1ec syscall(ffff80003a3a8890) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xa2d2ec2fd00, count: -8 ddb{1}>