_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7c26}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xaa29}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x20040000}, 0x40008c8) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0x7, 0xffffff7c, 0xe56}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000100)={0x80, 0x7, 0xfffff3b5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x40000008, 0x588, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000040)={r5}) 14:26:33 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0xffff, 0x670000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000040)=0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:33 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = getpid() ptrace$poke(0x4, r0, &(0x7f0000000000), 0x8000) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x80000000000, 0x24200) sched_rr_get_interval(r0, &(0x7f0000000080)) 14:26:33 executing program 4: socketpair(0x0, 0x6, 0xa, &(0x7f0000000100)) 14:26:33 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0xff, 0xc0200) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x4, 0x4000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:33 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000002280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="8f275332c1231a220ad724a7e98d0998196ae56f67c0a9625fdc", 0x1a) 14:26:33 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x2, 0x0) gettid() ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:33 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000000)=0x416) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:33 executing program 2: sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f00000012c0)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x14, 0x0, 0x2, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20048000}, 0x1) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f00000000c0)={0x0, &(0x7f0000000080)="a799082ed53a7fc4791ca1bc052e970321b7a9eead46a8f63a6c784cf86a81226314f4d5"}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x401, 0x40000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000002500)='/dev/bus/usb/00#/00#\x00', 0xffff, 0xc2000) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x8008551d, &(0x7f0000002540)={0xf0ed, 0x17, [{0x1, 0x1}, {0x5, 0x1}, {0x8}, {}, {0x0, 0x1}, {0x9}, {0x2, 0x1}, {0x9}, {0x9, 0x1}, {0x8}, {0xb, 0x1}, {0x8}, {0x9}, {0x3}, {0x9}, {0x2}, {0xa, 0x1}, {0x5, 0x1}, {0xf, 0x1}, {0x9, 0x1}, {0x3}, {0x3}, {0xc, 0x1}]}) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000001340)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(r2, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x3c, r4, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40c1}, 0x10) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000140)={0x0, 0xc, 0x101, 0xffc1, 0x1000, 0x7fff, &(0x7f00000001c0)="3a3577a6a10b5ed4ad74053921454261fc9165baa6dfb3e28ffaf9f03e70276444e7b55e547aa926e75aef437c687124b44919924aca3ef90b7a52b49274d03307633b822e90e788b26af2d9a069ca85332b3ec69cab66a9420d5aae44b46b2d6c4493d4d7b9d55f9c35003411acd1f5bedb3589df11a922c796461c3ea7a9c99490e5f632d19e75345bfb64c06fb65c530545db8dc1f89884b19a25c0ba538994c8f36590325eb7195af27690cc25411635807921ef2d39f7c66ea8df8cc4e954d05d34fdd2e2dac48c1dd3854871e3ea0c36052d08203be554e5e63047f858e14d5ff01f49914aca31bd6d2ef63c6d39f1608535f63870c99c52a287814b222710a5a7eeb19f87d7d2c3db80eb2367888465aaede706a359cb7f6e92004825fdf419fe6950755061cf01e7fba44799066cbac7114720070c4b5d9be52158728aaeea4b3d0f54a153f2963551de09ced516f35e7de4a9754481f7e924742da3b30de38d8a954f706e3efdb7fe5c17e5e5f0b7bc464876030ce688b1274318d70f14ac56af11edc7315d079b88a140d302f00f2731e7df3ca37240e04025b6e9af7207fead8cd5d449a9a4359001b5b7ac51e4c46d6f9a5fe76d67ecc16ade4bca552a304094c215900ca3bedb1dd20c0d8375c4fd90fc429a1744b727795e75c72561ef7eb879b69329d97bcdd6380ab93efd14f5d9b020ca5df3c0015c9b180f5d98fa8e63cc73f08e156f44448779ba2b315c51dd5fe52fcd0c3053cce48ee9abe77a9ec30dae74cfd2cb5b5d815bc1873ec3e0ca6e143beaeab2ff5ece2e68d849cb897617b11567a51a4e26cc183f11dd5fa28dffaca6a46e4f1c111e44034cbd9569dbb956e949ba182e66d62a3519c78a6d3d77de6a682e3c2825c05ccd9a4e0c36ef6f5e5dfc2a04199868cd2028a7f620ee0bf94183129a1058d448363e733eb7196f91a6964ce04a0aaae914ee39a4aa143618e2a458e9eafb2e21fc4025bc7e42ce3694e8a17899935f9c2700df0942eab68aacd728e26685e6669df37aa7959b06319d957b0527ded6b17a0c01eeb17750fd672d4e9a352060ccd2aca48e465391c97bbcd4838c269db14d8fd6bae9bc9cc3395e36f5fb082ddb4a185f2f2f33b823724da19278c4afce9a1fb11482bffef30259b6031353b562a920785d0d72153845f95819a83bcc071fc95d7ec2c1e6e14d67092c9c9949f328e4b9cc104115d77f697fef3a4079a7c868f6ab7c6f7f122269b74c19778cd31e4e1731dae28dd8ae6c4f2ae06fbec7c88762605457f67ba9bb970f25710bf37c0b73e506748f5eebd8b964781927aa5f2a9cf022608eb4129d7f705578ae5ef6f87bc33af985a556e05b564501e11312b4fc6b05f546db1d1d99c8bcb26a6eb1d3568e1b30b1e8e8b473b183a759e957ad1aab8f74d8aaa3dd76bc2addc78624820baf7b874c9aa60c63de9bead80d1db77111fde1b27936e2a995ee6b72680778c0174facd12dd0dd1d1213cd153a5fbfdc5dbf2b76523bb705c90bd63a77f4fc0f30cdfb75921cdcd483da4b5d6fa1a6346d37be93df9639b959754454dc64b8c4ece28e35d66f63d64e702313041e5a410aaa6f2745a48c9ad2bb1fce6252afe3956e8a1df4e2f53513a99ad24d5b5c12f8fb49f6c9c3991e4e89ae9d279f1253ebd66b090be34fd6e636f2894a045a6a1572062136025a28d576975d2af61cbf05ccdbb778fdcdb6aed72ba2e377be82e800b2d7ef0d851c847c055eaeae61c0335b7453a3d84721b261247f8b9758ca777d2629f36cfa4e830a58f08f27caebd2c4ff067e40efbdc1c6d5c6dc745d27b5c4b29f2e3efff54ddac90cd54e4374f054cb174761d75b42284d089a69e682030206377d05f8bf8497f934b22ed96772f9c65c13e8b6bd2ca8e188b583f6ebc1a71ef9ddc06b760aa43a17301c46347bc0c9870e9c6bbd468013f6a26c3b73ada87e526e35a658d2569eff5d1c7e89703e62939a92461e12976bed698204c465546d7d204e98f948665ffd7b6dd3ba206b11813cc21cb2c78a55b6bdf1fd9115acbd4c5673ed7c728080e6b12ebe277b5788dda19f82496316f03e2693edc83c754ceed9e2b519cf2563ffc0328fef5dcb8e8b865c5caffdf33acc273510c1148a51effd5e6f5747236c18fc960a3dd0ec0c8515cc255fc69d31034fbac3bb0d3353b3191cc06012397533bdd5f02061ae4957f60e9a563a4ebbdc1f894aae79e59aa73564fba017f493bcb96ec0759e33b3ee1f3178aa432bf1e38c5f4984f6e7d17000f05f72e70a6f68ac388fa56748f3b8a0ea234a11f57d4835e88d57315c7342bef04600abb2f27bfd1a2d53c25a7aac224c53b86ba06bd85e1df9dc499bb4b5ce52980f29e9d2e2e26592349161caff99fc221cd394c4ce9e22a240f2defef118757c76280bde321a75b5e973a4e193bcba493bed969384050c6fc8d1eb7fcd822d39540582e45291d5768236c69341d0cf17c8c36af8b15b1c4588eba6c2584f1f7aaa38ab91616c3a89fb9880945dd34c35568d3aadb71c570020b0d60d438870f4fbd55dfb5cf96c79c988e9eaccb1e6d26e373edb58ab7b58d821138639647b2b1ed240ad6a8a804a7e09ee383e7f7c86ad023c741e53123837f2c45da75b1a80fcb49c1b810a564a1b49f6ed4fb1f0ae2039bcd04cdc0a60446a19e822f69fdf7024da015296785c7eacfd74baa4964c8829f9ba8ce5e49d3055c891f8b11b0bd75065d51d0737846bd510f8c89e850fc5b70b718866d85153dbaf5aa8c004722dc10eabf5eae5571d01bb660c8d8332c3f63c01809e56e96392f2f750c962131c918b95f1a18495df07347e195fc84b4cec716f4dd59599dcd7a343b38f69c8602f2367741e2ed765f3fc28fe1b6bd242348e614e5369cb9ea855ccebd0c0c9a7d60e205fe5da7e7c7838b4afe30ab95711c59c21f0e734b53fd5d7c4ae6700a2949b3e9c8b3b6bb5a4b09e0d95c12b28120d0dd4a09b415f095bde369cefd3ced16f5471b45e500923ff4a73748179479ae69f6b3bce12584e9ca9076b7151c159aff08e21cc2bc1f3b371de3090f61abfe0b720dce127d66346a4a91f9f36637cbdb574faa5593b6409b7b12a29c64f024149617d50bc7b52a680f9b8fdf8f6cf27731ec1f57eb89ccf67fa92e34f84223f57e1de783d887a74fe25fdd384de75e9b7ff9bcba9abbd0c9f199d1c1a7ebcfc64f40e9a60df7bbbe94d6bf8d87535be5452b367c92b3ea1a3ddafb2869bf4f4f10696c06fc944f1ed407498e1fb4e13c07cc408523f428ae988a51afbb63d6a92256b55a35067f70536dc1c5fbfd9f6182df766696b7cd216a893c530c40c8c4c99b9d0c3565c6609ed2c106c64d4a36f790e2996dadf9db9b182d24561087f2671c8b57f00df3142d3e3697c4fa4954399d7b4989a4238685bee3ee088ff35089c0a79a54dd47aecd65a5cafc95a6d4a41a1276031c49c842426a54d38a0f1db098633dc4c00c1b112cbaa267aeb1ec253b8c86b057140f632e9661d31b3a0745029213ae8d284f15e9a7254735e2491ed5a3af6e986ee2fa3bb495caed72f769ce338fbff744f045035a8f46ae4911a6b2b930535ef748388d27abd9081a746bb2a04baa5da994a63e222df47aaa0e9dcebedde7084abfe7bc3a75bd8374f945fd3ad6be43239dbb3eab8378c42d25b33a90135aa84e61065ff28694b304944edc29143410fbf85a5115b255fe773006bc89036b75384652459ff52a1f336f1c2e2dac73f2fac888a714b791b6f28de0c4c4631f73994e025dd9dc18e1541b733800c6ad76f1afc16c2eee074243ed193d7752f4afd738782978584c1d66841eadce386698da2d22113fa741fa7f5629068d63cff4b4a35259345f1c0618b89fd22ca21baa11b4761a33a2876e1a42e961d54e22e9c436222ef918c135415456ecf81105a2f2b984f43f1add96b8da371413d7460082c002e7afbf8f7ac2df398bce70e57db706d3c85cb718db8f5c507b0a9bc56744294dc4731a602860181c755287658e583d0fc4f4885d0c1ef4f302a7d5929f1d15378cf0537f389a6c669cd09e1b1666e337c5ed79e9f09849bf8558bbc81e3b29c355797f71953d979972c37597ba941c5dabc3afaa0b4b3b3b6ca351a0ac919352ea56c02b685024e4961ef9699ee3fcabd423d5c9b852d6eaf99ea77e7a986c290dcf2b3ed0171d88a649bcc8cb00661b49303ea596545e1501473bd6607475355f3585c7c9ece662a45e7d71c308e1d188e10949656a42461b2ba6464f20a7735a083c327ace9403910c3a1b7a88919bc7e9e5ae6809f57e6952fb3d5f6b44fbff4902a4eca46962aa41e897421ba3fccd9a076e4156e81ab6027ed8098d1a257a3a2fd252d2c46ee28eb928edb65a02f4e9ba5052618efdb024c11fd4715268b46acf65dff378b3269267cce79f5218921c4701c85a412f2fdd33fd025eaf606f71c671f46503fc6fc1030961b2d167e5837dfa2ba3db665850aa8de26a7bd8982171331f049138663361a4c44a4cc20e6dcf94489e136f84b979a1b7fffa5c9e5ac888de4c91b3040dd2c86a62f2bd4ec02529a6102dda01b9b522011162bbab4e6a4dd8f5608c42bdcb2ed1290d1c4a16d74cba57ddab37177df11b010b3fbb64f9faad70ed7a56d1d92d47eef213a2481f8e8667d7d18af400d9f2a300cb0420360314ec28a34c91c994077c9d663b968b0d2432dd6ff01e11dd5be56dfd311ca60d76f9e6ca37582e18f9cdf334592cb19dec95cc363420b192ed23d888fc0dbaff91b6c87be5d13a74129e064697df48561eaa3a9cd70dd8685fb79249c8419bb1c49793dceda0c2b1a4193277bd169a920150b58f070b967a4d9af0a5db0ff3966a33b050c8dfc638e61f7a40dd108e7d42040793d03bd600b1d981c9c251ed083eb504b04012c48018ab37b04a1834b921280c171bbfd5e0f394365836ce41ca674db9a09d77516fb62d6f0e7f5ae875991420dd3fa45e67c0647be7631a324facef3c73ca20811cd517bcef63813eb24d745bd7190e4043b5a4180fd2cd76ef9593e08e1b37cccbea68ce59fb42c5cc57630139ea88782a087cb1ecabc15e54fa1aa571ce7d9fd4e63dc6f6ee4a661b67c94001e5edae6d4991315d3c956f3c5c70a95d327e4c2c2b8ebfa062d1ac12f9872521ced10e89ef6789f59faa84250a881ce4debf951a83f3a46fd3cfbfdd08bcb249ef6c78dc3ece3eaca1ece8ed64c5bfa80dc0248420a79de59f95504607e921708599ff9aba38883eab9c765e70cac73e264808bd9013f213d60953a5627fe4348d741fd6eeb80b9722009a391e25147be81ec94793c4fc2bebb4c86d6e42a401f147f533da31f6072ff08e078a2a4c9710914912b20d268a5522be8addb04eb12d43d2390ccf744b3a2c0a0cfeef376fe4ebc6baa6b86156cff7f72cffc37de237c069cddd4d1469985580aec1b7ef53e7a5a749431598fbf3730e18acc7b5dc994c6ebad5f17d725be835038c553396d3cf0ae64c4ba4d3a55c23e5a43442344133483edf2c49c3d098d4b10f222a71c3987516067ccdc58c2ab7b857d7f80cf2f09ce10ff1f0d57c89dd36c6ff76f9920d85629a320297d9637ac58320fbf3c8cf6311a8092089e34a84e1fcc0550741b00e1228b08f100de3e294f8bb67ae3bfeb05865325dba6571bb284cf64cd1e54035b3e0212fc8bdbc929b89c3b42b777e9916d2947ad72bdf4b22911ea37ce1b770db535482c317ae7dd01b81be2cd2e"}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000001240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f00000024c0)={0x0, 0x0, &(0x7f0000001440)=""/6, &(0x7f0000001480)=""/52, &(0x7f00000014c0)=""/4096, 0xf000}) 14:26:33 executing program 4: socketpair(0x0, 0x6, 0xa, &(0x7f0000000100)) 14:26:33 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xba, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x0, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3ff}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7f}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x4051) 14:26:33 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) r3 = syz_open_dev$usbfs(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x100, 0x2c0102) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000100)={r1}) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x8008551d, &(0x7f00000000c0)={0x8379, 0x19, [{0x3}, {0xd}, {0x6}, {0x8}, {0xe, 0x1}, {0xb}, {0x4, 0x1}, {0xc}, {0x7, 0x1}, {0xa, 0x1}, {0x9}, {0x7}, {}, {0x9, 0x1}, {0x3}, {0x4, 0x1}, {0xa, 0x1}, {0xb, 0x1}, {0x5, 0x1}, {0x7}, {0x6}, {0xe}, {0x2}, {0x8, 0x1}, {0xd, 0x1}]}) 14:26:33 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r3, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20048000) 14:26:33 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) r0 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00', 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0xe08, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000090) 14:26:33 executing program 4: socketpair(0x0, 0x6, 0xa, &(0x7f0000000100)) 14:26:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20044}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x44, r1, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffffafc0}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xb5c}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8040) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) socketpair(0x21, 0x4, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r5, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00%', @ANYRES16=r6, @ANYBLOB="200025bd7000ffdbdf251100000000000980000001006760000000000100ffff00000000010008000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 14:26:33 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) socket$unix(0x1, 0x1, 0x0) 14:26:33 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x3, 0x460000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r1}) 14:26:33 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) getrlimit(0x0, &(0x7f0000000040)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xffffffffffffff44, 0x204943) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:33 executing program 4: socketpair(0x21, 0x0, 0xa, &(0x7f0000000100)) 14:26:33 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x7, 0x509000) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r4}) r5 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x401) inotify_rm_watch(0xffffffffffffffff, r5) r6 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r7 = inotify_init() inotify_add_watch(r7, &(0x7f0000000000)='./file0\x00', 0x20) r8 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x80000000) inotify_rm_watch(r7, r8) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:33 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r1 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self\x00', 0x410c42, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f00000000c0), 0x1, &(0x7f00000001c0)) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_CONNECTINFO(r2, 0x40085511, &(0x7f0000000140)) 14:26:33 executing program 4: socketpair(0x21, 0x0, 0x0, &(0x7f0000000100)) 14:26:33 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r2, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xffff}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc001}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000580)={0x0, 0x95154e1b1c715826, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f0000000140)={0x2c, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x180, r1, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0x8c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'rose0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x9, @local}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast1}}}}]}, @TIPC_NLA_MEDIA={0xe0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xbd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe5a8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x96}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}]}]}, 0x180}}, 0x8800) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:33 executing program 4: socketpair(0x21, 0x0, 0x0, &(0x7f0000000100)) 14:26:33 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001780)={0x0, 0xffffffd4}}, 0x46011) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000229bd7000ffdbdf251100000008003200ff0f000005006cd764f7000008003200fcffffff08002b000300000008003b0005000000df645078eaa402e5c00d0e941fc0d7db4a9d052f3e9552f28c62a8f3390f020ee6dfc73918df50055a19a4d229bed1debfe82b49242639e605d06da83d9caf0d1657dafd16458d12ca8bb8a3188e34a8333e852c608d57840836fa1ba506d33f93d7bfd6bc62284cbe172f2322dd84ecd9152fb682e2aca3205933ef05dfffeab90e1916aadef2813836083f8f1fd094046ca3d45e4370cc998f2fa48f8d70db5b01728f2daf1c8e3da7f7ad8600f0943dbf58c728fe5332820484229079abb433ca1daf360c5b4550cd984b94824600"/271], 0x3c}, 0x1, 0x0, 0x0, 0x4000081}, 0x40000015) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:33 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x7ff, 0x10501) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) 14:26:33 executing program 0: r0 = getpid() ptrace$peekuser(0x3, r0, 0xfff) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000280)='/dev/dri/card#\x00', 0x200, 0x406141) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000040)={r2}) sendto$phonet(0xffffffffffffffff, &(0x7f00000002c0)="4c9ed6638ff7a44a210639569f73b7bebc1783f2f1f77d7b00e7e5873fbe60950206a344fbfed16e419e58dd2b44b78ea574907f1c4a439208fe710cc4f893ae211df24efc874639ac37ca59c61047959a527a41d40b6b7047cf978911f77eac7d84faf229781c5d0a093760a433fcb82e02f425d5cf589ebbc03de34053317b64375759403bb7d4f27be39aea8be704060082dff44c230743a00526597e8289c1ce3c82d5cb45740840656fa9fa3f1654de015ccd05b7e61ef11175bb264716b8bc15513429735c34b10b21f61491eded40aabc9c352ebabfeab938d9f1c5dfc9777627c607902439ea614306a84faa791f254618d855ba23a1b411b49e0c7719727e34c3d0a2f7f76ffaaf01246e7760f89ff4522782da171e76dfa4031eb93c5814df430930e9fbe4af8389c9", 0x12e, 0x0, &(0x7f00000001c0)={0x23, 0x40, 0x0, 0x2}, 0x10) syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x4, 0x40040) syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x10000) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x3, 0x3f, 0x1000}) 14:26:33 executing program 4: socketpair(0x21, 0x0, 0x0, &(0x7f0000000100)) 14:26:34 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x4, 0x3, 0x6, 0xffff7fff, 0x1024, 0x1, 0x4, [], r3, 0xffffffffffffffff, 0x4, 0x4, 0x2}, 0x40) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:34 executing program 3: r0 = getgid() r1 = getegid() r2 = getegid() r3 = getgid() r4 = getegid() getgroups(0x4, &(0x7f00000001c0)=[0xee01, 0xee00, 0xffffffffffffffff, 0xee00]) getgroups(0x9, &(0x7f0000000200)=[0xffffffffffffffff, r0, r1, r2, r3, 0xee01, r4, r5, 0xee01]) r6 = socket$nl_generic(0x10, 0x3, 0x10) getegid() r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r8, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000040)={&(0x7f0000003200)={0x2fc8, r8, 0x4, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x31}}}}, [@NL80211_PMSR_ATTR_PEERS={0x5bc, 0x5, 0x0, 0x1, [{0x40, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x116}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x8e}]}]}, {0xc0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x8c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}, {0x1c8, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x1c4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xf4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x55}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xc4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x48, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xd86}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x2f0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x3c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1f}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x31}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x11c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x16}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xd187}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xd4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xea6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x12}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x24, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x140, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x68, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x90, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8001}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xf}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7fff}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x9b4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xf7d9}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}]}]}, @NL80211_PMSR_ATTR_PEERS={0xb48, 0x5, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0xc0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0xbc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xa8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x80}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x4}]}]}]}, {0x150, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x104, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xfc, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1a}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xf000}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x34, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x18}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x30c}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x35}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x14, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}]}]}, {0x304, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x2d0, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x11c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x86}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8000}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2a}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfe}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x12c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5e}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3f}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2f}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}, {0xd4, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x30, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x84, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x48, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x10, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}]}, {0x1c0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0xec, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xe0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfffc}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfe}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xa8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xdd}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x29}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1f}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_CHAN={0x14, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x39}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x60, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}]}, {0x330, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_REQ={0x90, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1f73}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x1dc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x98, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xb4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7f}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfff}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3f}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x99}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xb}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x44, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3b}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_CHAN={0x34, 0x2, 0x0, 0x1, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xe}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x80}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5301}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x40}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2f}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f7}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1b6}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}]}]}, @NL80211_PMSR_ATTR_PEERS={0x1960, 0x5, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x9c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x410, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_CHAN={0x54, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x16}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2c}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16d5}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xe58}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x4}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x34, 0x2, 0x0, 0x1, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x286}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xffffffff}]}, @NL80211_PMSR_PEER_ATTR_REQ={0xd8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x288, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x401}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xa8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x70, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1f}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x5b7da1e44d675058}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffff}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xf4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x18a}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xe2d}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x79}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}]}]}, {0x49c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x174, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x170, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xc8}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfda5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x11}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x14, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffffa}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x100}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x9713eb4c76d53ffa}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x10e}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x2e4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xc8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xff}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x14}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xb4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x120, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xaa}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x48, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x16}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xf9}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xe4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffff}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2ef}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x27}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x80}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}]}]}, {0x1dc, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x4c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x21}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1c6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3df}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x150, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xe8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffff}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xee}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x58, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x47}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1fc}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x3c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x100}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xfffffffe}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x31}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5018000}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}]}]}, {0x3d4, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffffb}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x18c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x74, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1c}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffff}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x186}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2b7}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x9c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x98, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x800}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9b}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xbf}]}]}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x12}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x17e}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x24f}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x4c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfff}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x200}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0xcc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xbc, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xd2}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2cfe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x200}]}]}]}]}, {0x70, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0x8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x4c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x99e}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x15cc}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x30f}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}, {0x50c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x54, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16df}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x80000000}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x97}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14a0}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x303}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x14, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x14, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x97b}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x185}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x101}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x34c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x78, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7f}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x11}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xbc, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8be}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xec, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xb5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x10}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x58, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xc0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xff}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x108, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x78, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xf2e}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7a00}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x84, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1000}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}]}]}, {0x3c8, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xd8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x96c}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x222}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x170, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x80, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xe8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xe0}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x144, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xd8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7ff}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x64, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4f9}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0xd8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xd0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x80}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5b8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xff}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x110, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7f}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}]}, @NL80211_PMSR_PEER_ATTR_REQ={0xc4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xbc, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x11}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}]}, @NL80211_PMSR_ATTR_PEERS={0x20, 0x5, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}]}, @NL80211_PMSR_ATTR_PEERS={0x44, 0x5, 0x0, 0x1, [{0x40, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x4}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x12}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x33}]}]}]}, @NL80211_PMSR_ATTR_PEERS={0x4d8, 0x5, 0x0, 0x1, [{0x43c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x7c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x70, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8e98}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x44, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x31}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x42}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8001}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xe21}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x32}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x35c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x88, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x1b0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8a4}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfff7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x48, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x24d}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x70, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xe4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x400}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x64, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1d}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3f}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x98, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x70, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x68, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x11}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8000}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}]}]}, 0x2fc8}, 0x1, 0x0, 0x0, 0x1}, 0x4000001) r9 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x4, 0x200000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) r10 = msgget$private(0x0, 0x0) msgrcv(r10, 0x0, 0x0, 0x2, 0x0) msgctl$MSG_INFO(r10, 0xc, &(0x7f0000003180)=""/88) 14:26:34 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x341000) r1 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0xfffffff7, 0x80000000, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000000)=""/51, 0x33) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)={r2}) 14:26:34 executing program 4: socketpair(0x21, 0x0, 0xa, 0x0) 14:26:34 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:34 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x80, 0x2b4880) ioctl$USBDEVFS_RELEASE_PORT(0xffffffffffffffff, 0x80045519, &(0x7f0000000100)=0xfff) r0 = inotify_init1(0x800) inotify_rm_watch(r0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xffff, 0x20440) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:34 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x341000) r1 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0xfffffff7, 0x80000000, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000000)=""/51, 0x33) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000140)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)={r2}) 14:26:34 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00', r4) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xbf}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x100}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c001) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000340), &(0x7f0000000380)=0x4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00'}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x4c, r3, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0xfffffffffffffd0d}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1ff}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xffffffff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) sendmsg$TIPC_NL_LINK_GET(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2000}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x8000) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x9c, r7, 0x304, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8000}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}]}]}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "0635fc27cc62c3cb33715bb3668645c819b6faa5"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) 14:26:34 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) read$usbfs(0xffffffffffffffff, &(0x7f00000000c0), 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000480)={r1}) socketpair(0x1a, 0x4, 0x1, &(0x7f0000000340)={0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0)='nl80211\x00', r4) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f0000000d40)={0x788, r6, 0x4, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x326f, 0x6b}}}}, [@NL80211_PMSR_ATTR_PEERS={0x760, 0x5, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x44, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x9c}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8000}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}]}, {0x444, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0xc, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}]}, @NL80211_PMSR_PEER_ATTR_REQ={0xfc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x5c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xff}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x98, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x200}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x338, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xd0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1a}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xe1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x170, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4c}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3f}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x30}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xff}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x70, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffe1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4a}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x64, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}]}]}]}]}, {0x1e0, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x1d4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x58, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7a}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xe4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x80}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3ff}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x353}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfeff}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x8c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7f}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x11}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0xe4, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x98, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x8c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3f}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffff}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3a}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3f}]}]}]}]}, 0x788}, 0x1, 0x0, 0x0, 0x240480d0}, 0x20000000) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x16c, r7, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "f8e50d74a3fedab6f5a0cc0f62b031e078063200b0a3d5c3ffbcb1fc4d"}}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_NODE={0xa8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "bb4e66721ab09d3b4d86d6f5c08ac3550fcc71e98005df6c"}}, @TIPC_NLA_NODE_ID={0x64, 0x3, "b94437ce7e7a7006290bfd83846bcbf900803358725d4b73765cf9e9ac07fdfd15cacd483acc8d84d0e801e668de9deee49ac9652add043d6c2101ae47e6c9b5f1d3324ba3328dd6b6f77bbeca20643f0ffe54554b5dd44eef21e9d978dde478"}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}]}, @TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfbb6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb41}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}]}, 0x16c}}, 0x2004c040) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000080)) mmap$usbfs(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x4) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:34 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x3, 0x460000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f00000000c0)={r1}) 14:26:34 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x4, 0x20141) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1fe, 0x10001}) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x0, 0x800, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x1c}}, 0x400) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0)='batadv\x00', r3) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r4, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}]}, 0x1c}}, 0xc800) ioctl$VHOST_SET_VRING_NUM(r2, 0x4008af10, &(0x7f00000000c0)={0x3, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000240)={0x9, 0x3, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r5}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r6, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x20, r8, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}]}, 0x20}, 0x1, 0x0, 0x0, 0x40040}, 0x20008095) 14:26:34 executing program 1: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x8001, 0x66200) 14:26:34 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x7, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 2: r0 = getegid() r1 = getgid() bind$alg(0xffffffffffffffff, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) r2 = getpid() syz_open_procfs$userns(r2, 0x0) r3 = gettid() msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000300)={{0x3, 0xee01, r0, 0xee01, r1, 0x82, 0x80}, 0x0, 0x0, 0x0, 0x9, 0x4, 0x0, 0x80000001, 0xa, 0x6, 0x81, r2, r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0xc95, 0x6, 0x62b0}) r5 = getpid() syz_open_procfs$userns(r5, 0x0) syz_open_procfs$userns(r5, &(0x7f0000000000)='ns/user\x00') socketpair(0x15, 0x4, 0x2, &(0x7f00000006c0)={0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r6, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) recvfrom$phonet(r6, &(0x7f00000001c0)=""/154, 0x9a, 0x101, &(0x7f0000000140)={0x23, 0x9, 0x2}, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)) 14:26:35 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x80, 0x2b4880) ioctl$USBDEVFS_RELEASE_PORT(0xffffffffffffffff, 0x80045519, &(0x7f0000000100)=0xfff) r0 = inotify_init1(0x800) inotify_rm_watch(r0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xffff, 0x20440) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:35 executing program 0: ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000100)) r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xfffffffffffffffe, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x0, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) inotify_init() 14:26:35 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x200, 0x102) r1 = syz_open_dev$usbfs(&(0x7f0000000200)='/dev/bus/usb/00#/00#\x00', 0x3, 0x2200) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000240)=@usbdevfs_disconnect={0xe0000000}) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x48000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00', 0xffffffffffffffff) r4 = syz_open_dev$usbfs(&(0x7f0000000280)='/dev/bus/usb/00#/00#\x00', 0x401, 0x141) r5 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r5, 0x80045503, 0x0) mmap$usbfs(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000001, 0x13, r5, 0xfffffffffffffffe) ioctl$USBDEVFS_DISCSIGNAL(r4, 0x8010550e, &(0x7f0000000340)={0x200, &(0x7f00000002c0)="da8ade700fb5cf1f32c5b9be8341737f450b39697c0338674f6189c0fd78e952da1dcc939b955c20edb78e5126b338a8909709b72971476c78730b9e88422d0a0e5749dc26a3b560bab523e42e2d02aa6c31badbcf304e873949b89644c78a5c"}) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000140)=0x401) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="600400009ca5462dc739efff065045fc238d11f2e7f19b919f8dbb3adf2ce4afa2e10473633f30f1a7a57a594af9190300000000000000d5", @ANYRES16=r3, @ANYBLOB="00032bbd7000fddbdf2510000000140001800d0001007564703a73797a3000000000600004800900010073797a30000000000900010073797a31000000000900010073797a31000000000c00078008000200010000000900010073797a31000000000900010073797a30000000001300010062726f6164636173742d6c696e6b00000801058034000280080001001e000000080001001f00000008000200f8ffffff08000300ff7f00000800020005000000080002000200000008000100657468002400028008000200020000000800020004000000080002000180000008000300090000004c000280080004000700000008000300040000000800020000800000080001001f000000080003001f00000008000400ff00000008000200bff76e3508000200ffffff7f08000100040000000400028008000100657468004c000280080003008fd80000080001001300000008000200370d000008000200030000000800030003000000080004000900000008000400050000000800030046ce000008000300060000002800018024000280080001001a000000080002000104000008000300050000000800020002000000c00005800c00028008000200957600000700010069620000240002800800030009000000080001000c000000080004000100000008000400810000005400028008000400f8ffffff080004000600000008000200ff0f0000080002000700000008000100030000000800040004000000080001001700000008000400800000000800030007000000080001000d0000001c0002800800010014000000080003000400000008000300010001000c00028008000400ffffff7f07000100696200001c0001800d0001007564703a73797a300000000008000300020000008801068008000100070000004300040067636d28616573290000000000000000000000000000000000000000000000001b000000c0c194ccf9c8e12328b38aaa709fe890033838f64bc6e8281d8bf70008000100d500c753e9000300e979dfb81b0ce9e83510624a83f80ebf9cad2ab9f22758c334d6e6cf62148a9b9dd43c0da50b456990078772b203af5e6ac560b365dde70ba0f1b884401f492fa3934c591dd3dba1e585e8e50f92bf605e79ef3580d9ce6d4b6436572d6c074c89fd43893dcb9dade55c083d1f055cc5353b46dc84be3b45d626278048fc69dff9af732b0dbcf4ddbf21cbd58dd75873319ce9cefcfb77ac0726849c51eca63032e87ec6defe39e78b168e6dccd9ead062387e6774147c5cb39ae3090647800145eabc18fe73cd7870ff03265c291133c302c9f0c036f8175a55f8d8d4f4b39fad0da343240000003f00040067636d286165732900000000000000000000000000000000000000000000000017000000d15645ba82cf9e85f948b4b4edf782d892ebed8dd79c8b00040002004400098008000200080000000800010001040000080002000100000008000100060000000800010009000000080002000400000008000200290000000800020008000000"], 0x460}, 0x1, 0x0, 0x0, 0x1}, 0x4010) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x2, 0x109603) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7ff, 0x40, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xba, 0x20000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x0, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3ff}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7f}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x4051) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xb7, 0x4001) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x3, 0x2002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0xff, 0x8, 0x7, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000100)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xffff0000, 0x1ff, 0x31044510, 0x0, 0x0}) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r6, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r7, 0x1}, 0x14}}, 0x0) munlockall() sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r7, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x401}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x20040801) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:35 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) ioctl$USBDEVFS_RELEASE_PORT(0xffffffffffffffff, 0x80045519, &(0x7f0000000080)=0x8) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:35 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x0, 0x62b0}) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x1f, 0x149001) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) inotify_init() 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0x80045510, &(0x7f0000000000)) r2 = syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, &(0x7f0000000040)=0x101) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:35 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x3b2, 0x8080) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20001}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x160, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_RULES={0x138, 0x22, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7f}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8001}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xda}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x9}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x80}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xffffffff}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x2}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x42}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x10001}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x3f}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x5}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x1ff}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x101}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x9}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3391}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xff}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xffffffff}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xff}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xc8f}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xa82}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7fff}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x2}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x4}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x5}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x6}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3}]}]}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x7f}]}, 0x160}, 0x1, 0x0, 0x0, 0x800}, 0x40001) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x100ea2) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0xffff, 0x670000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000040)=0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000100)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000140)={0x1, 0x1ff, 0x7d, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x8}) 14:26:35 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xa4, 0x453, 0x400, 0x70bd2c, 0x25dfdbff, "d11de3304fc60557e56233303cf581646094cbb4e5ef8377078d115860d2e5eec57c5599d94b2afd5786efd5ffb2ca6115e48953135336491d3efc67d8a05e190969841ca8e8e3c61d36f45958192a570006698b818827f613268e902ee4900c5944020e66017a950f0cab4e0ac5317779ac46a1b71a289442dc4f30d7ea8d388c9454bd18422d08a2ba6ec2b1c2be272e", ["", ""]}, 0xa4}, 0x1, 0x0, 0x0, 0x41}, 0x4044010) 14:26:35 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xc96, 0x4, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 1: sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000829d57000ffdbdf25010000000000000001410000561c001800170000001b000001ff69623a715af76c8906cc47b7e9c5a67d313465727370616e300000"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x6edf2846, 0x42040) r1 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x6, 0x28000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x7, 0x8, 0x69}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400c018}, 0x20004000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0x1, 0x80000001, 0x8000, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x6, 0x800) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xb0f, 0x200900) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000040)={r3}) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0x80045510, &(0x7f0000000000)) r2 = syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, &(0x7f0000000040)=0x101) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) mmap$usbfs(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x12, 0xffffffffffffffff, 0xffffffff) r3 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x100000001, 0x1) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f00000001c0)={0xffff, "b299196ab04c08997fde6de73e86265f2b470bef46ed77c588c0bcb430a09f8c9fb1bd38faf525bb114d982a9b43c451e7d3e22bfbec51cecd0e245e65a77822a2e701b05a16b32fb962d02303018889da9fd84b6260d5539636f49150445dc85b7e342ffce0ad4d391c0ee11484c307d437d1d30300d27f1f80780bf7ff2a65f9dc64d2fcf900e1f5dcc5964545cc494764bdfeb06a0078cd622b55f891bdec97318a7f25468de460c59cf9ffb9148e0d614b738bc3d725aa2686629b15c0da556a264df2d9f7547450c06e0873f5930a8c90db4b9110d8f06144690807e01cbd5c020f467b66587633c8a534eb7ab98f736f4665882493f77c3351b96a4f3d"}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) getitimer(0x2, &(0x7f0000000080)) accept$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) socket$alg(0x26, 0x5, 0x0) 14:26:35 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0x4803) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x2, 0x0) 14:26:35 executing program 0: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000000c0)) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x200000000000, 0x103000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) socketpair(0x21, 0x6, 0xa, &(0x7f0000000100)) 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x0, 0x3, 0xfffffff7}) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='threaded\x00', 0x9) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)) 14:26:35 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="100c3cbd7000fbd9f6ed0000000000000000430000023e91d8d368", @ANYRES32=r2, @ANYBLOB="04000380"], 0x20}, 0x1, 0x0, 0x0, 0x2000000}, 0x28005) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r4 = gettid() sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x3e9, 0x100, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x1, r4, 0x8d, 0x10001, 0x6, 0x1f, 0x0, 0x7}, [""]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x8805) syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00', 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) mmap$usbfs(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x12, 0xffffffffffffffff, 0xffffffff) r3 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x100000001, 0x1) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f00000001c0)={0xffff, "b299196ab04c08997fde6de73e86265f2b470bef46ed77c588c0bcb430a09f8c9fb1bd38faf525bb114d982a9b43c451e7d3e22bfbec51cecd0e245e65a77822a2e701b05a16b32fb962d02303018889da9fd84b6260d5539636f49150445dc85b7e342ffce0ad4d391c0ee11484c307d437d1d30300d27f1f80780bf7ff2a65f9dc64d2fcf900e1f5dcc5964545cc494764bdfeb06a0078cd622b55f891bdec97318a7f25468de460c59cf9ffb9148e0d614b738bc3d725aa2686629b15c0da556a264df2d9f7547450c06e0873f5930a8c90db4b9110d8f06144690807e01cbd5c020f467b66587633c8a534eb7ab98f736f4665882493f77c3351b96a4f3d"}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24280) 14:26:35 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, 0x0, 0x200, 0x70bd27, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x20, 0x64}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x1}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x8001}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xff}]}, 0x44}, 0x1, 0x0, 0x0, 0x8851}, 0x6008005) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0xc851) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x57646c6e, 0x40c000) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x1, 0x200601) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x8000, 0x511540) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x200, 0x4, 0xa5b6, 0x0, 0x0}) socketpair(0x23, 0x6, 0x3, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xcb46, 0x200) ioctl$USBDEVFS_CLAIMINTERFACE(r1, 0x8004550f, &(0x7f00000000c0)=0x6) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x2, 0x11500) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) 14:26:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x6c, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0xffff8200, 0xc}}}}, [@NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x1, 0x1, 0x4, 0x0, {0x1ff, 0x80, 0x0, 0x3fc, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x1, 0x56a27bfc, 0x9}}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x2}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @NL80211_ATTR_DISABLE_VHT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="9686c3fb72ce"}]}, 0x6c}}, 0x80) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:35 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x40000c96, 0x1, 0x62b0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x20, 0xaeda, 0xad24, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r2}) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x80000000, &(0x7f00000003c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x6, 0x565a9e83}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r5, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x90, r5, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7fffffff}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x969e}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x10000}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}], @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_OPER_CLASS={0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xa}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @chandef_params]}, 0x90}, 0x1, 0x0, 0x0, 0x24000040}, 0x0) 14:26:35 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 3: setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x100) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x1, 0x200601) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x8000, 0x511540) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x200, 0x4, 0xa5b6, 0x0, 0x0}) socketpair(0x23, 0x6, 0x3, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x200, 0x9d, 0xffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x100, 0x20000200, 0x7f0003, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xb7a, 0x202482) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0xfffff000, 0x8, 0x10000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:35 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r1, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffff9}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffffc}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x8100) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_MON_SET(r4, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x40}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x810}, 0x85) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000040)={r2}) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x7, 0x80000) 14:26:35 executing program 1: ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0x80045515, &(0x7f0000000140)={0x1, 0x1}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x80, 0x0) ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0x80045515, &(0x7f00000000c0)={0xe}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x5115b459, 0x2, 0x6}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x5, 0x4000) 14:26:35 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0xc8, 0x453, 0x200, 0x70bd2d, 0x25dfdbfd, "752f07a15a7c315f74a0b7fdb5b20a3858898a48bd2baf3af9006c84a64d4597f5d8b2c9e3d22a59973bde2d008c56d8d673fde61739fa2d055764060f5e836c2f73c2d409a22cdf2f9ffc3fdf0c8b4074b89e9e1a3582b9e1030eb6d1f5652defee30851fae1d8b0ff355cfc32671749dec3083b2e29ae353554e9931e9b5096f7ee35bd23bc5dd7a1442b0c85b1025d7843e505903aba89a2c2754af1dfd332854b324df7fff6fdf6e04c8f1d207874c5abf241e33", [""]}, 0xc8}, 0x1, 0x0, 0x0, 0x4}, 0x20000045) 14:26:35 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) socketpair(0x27, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:35 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af13, &(0x7f00000001c0)={0x2, 0x5}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r3, 0x800, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1f}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x881}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240)='nl80211\x00', r1) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="5c00ec8cbebdbc719d59bb22e4afba07662a0000", @ANYRES16=r4, @ANYBLOB="00082dbd7000ffdbdf252e0000000c00990020000000490000000a00060008021100000000003000e3800400010006000300110000000600030005ce000006000300021b000006000300040200000800020009000000"], 0x5c}}, 0x40800) 14:26:35 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x1, 0x83) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x7, 0x7262, 0x1000, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000000c0)={r1}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:35 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) bind$phonet(0xffffffffffffffff, &(0x7f0000000000)={0x23, 0x8, 0x3, 0x56}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x4, 0x80001000, 0x1}) 14:26:35 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) socketpair(0x21, 0x6, 0xa, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) sendto$phonet(r0, &(0x7f0000000080)="62a17c5c830051a521eeb0d6c3b5749853afcfd428895f1fd9657f2da07286abb481f32bae9c31a63954b6190e17a2eda9e0dfd4a32aafcc18a5cdedf0dd4187639d5844492120816fd55872d7d11f1df993", 0x52, 0xc010, &(0x7f0000000000)={0x23, 0xa3, 0x1, 0x40}, 0x10) 14:26:36 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x4200) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) getrlimit(0x0, &(0x7f0000000080)) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) 14:26:36 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) socketpair(0x21, 0x6, 0xa, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) sendto$phonet(r0, &(0x7f0000000080)="62a17c5c830051a521eeb0d6c3b5749853afcfd428895f1fd9657f2da07286abb481f32bae9c31a63954b6190e17a2eda9e0dfd4a32aafcc18a5cdedf0dd4187639d5844492120816fd55872d7d11f1df993", 0x52, 0xc010, &(0x7f0000000000)={0x23, 0xa3, 0x1, 0x40}, 0x10) 14:26:36 executing program 5: r0 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00', 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x50, r0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x212}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x1800003, 0x4200) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x9, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0x202, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:36 executing program 3: sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x7, 0x3, 0x15b}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000300)={&(0x7f0000000180), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008004}, 0x20000000) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, 0x0, 0x300, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfffffbff, 0x37}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4004805}, 0x4000084) 14:26:36 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x101000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:36 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) 14:26:36 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x8, 0x400080) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x2}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x4}) socketpair(0x15, 0x4, 0x2, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) socketpair(0x8, 0x2, 0x101, &(0x7f0000000140)={0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00', r2) sendmsg$NL80211_CMD_REGISTER_BEACONS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00e624bd7000fcdbe1255500000c0099000800000000000000301f007a3056b1a14772c3fd9e2811fd902be7b62930a12e98b09d17563e4f2e560b45cb69eb55adad6c03c164d8834e10cf7b64fd07586169a4e33009af7ccb99c17ed62dedb8cea966f4b05a2e0a281daab8be2f47e9f0d92134192be7d23cf1bb5fa16bc652"], 0x20}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000) bind$phonet(r1, &(0x7f0000000080)={0x23, 0xb5, 0x8, 0x1}, 0x10) 14:26:36 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_KEY_FLUSH(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x11c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x80, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "a1184e5287536b0047fd8e2a7971b8098e6d95269c8633b174"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ID={0x24, 0x3, "0037a5f1c6b919783212a085e085da6963ed10d99ef1acb444600f1a7f25ea47"}]}, @TIPC_NLA_NODE={0x88, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x78, 0x3, "2b6cae3a28c24e0164824e2811de6bd3284ae2678a4d78abff596c5452f4d80669c1540da1e84ac5742a971de1c97ac4f077ec2e0692db2de4c95f2c40d708c727cf3bdf71ffdd9b86336f66c849aa2cdadbaaba5748723762c096f5639b2f96705dbf800c07a3d0885bbc12bea05cbfbb8d534a"}]}]}, 0x11c}, 0x1, 0x0, 0x0, 0x2404418c}, 0x4000800) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:36 executing program 4: msgctl$MSG_STAT_ANY(0xffffffffffffffff, 0xd, &(0x7f00000002c0)=""/83) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xd894, 0xd9, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 14:26:36 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) tgkill(0x0, 0xffffffffffffffff, 0x36) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x7, 0x202800) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000000c0)={0x8, 0xffff, 0x6bb}) 14:26:36 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) munlockall() ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) r1 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000040)) recvfrom$phonet(r1, &(0x7f00000000c0)=""/58, 0x3a, 0x100, &(0x7f0000000100)={0x23, 0x0, 0x3, 0x2}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x4, 0x6}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x80800) r4 = syz_open_dev$dri(&(0x7f0000000440)='/dev/dri/card#\x00', 0xc773, 0x200000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000480)={0x10ba00, 0x5f975f96, 0x3}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0xf, &(0x7f0000000800)=ANY=[@ANYBLOB="3d620400040000006ab05000100000005c33300000ff000018390000000000000000000018250000000000006379f9409793a187cb83684044dd0f5f5c3f2b7782395765648b2bcf0c3318b5b99540ddc008e0ee489e6d412de780a30dc8c1288c65b13685349f3e1e196e17c82d0ab44e66917a7f125e41008a", @ANYRES32, @ANYBLOB="000000004f00000018160000", @ANYRES32, @ANYBLOB="000000000000000018160000", @ANYRES32=0x1, @ANYBLOB="0000000000000000ff1f820002000000d540e0fffcffffff18000000030000000000000005000000"], &(0x7f0000000580)='syzkaller\x00', 0xdaee, 0xfe, &(0x7f00000005c0)=""/254, 0x41100, 0x1c, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000700)={0x1, 0xb, 0x7, 0x3ae}, 0x10}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000004c0)='vnet_rx_one\x00', r7}, 0x10) sendmsg$BATADV_CMD_SET_HARDIF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1}, 0x14}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) sendmsg$WG_CMD_GET_DEVICE(r8, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x90, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a='\xa0\\\xa8Ol\x9c\x8e8S\xe2\xfdzp\xae\x0f\xb2\x0f\xa1R`\f\xb0\bE\x17O\b\ao\x8dxC'}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r9}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x44) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x9838a8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r6, 0x800, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x80}]}, 0x34}}, 0x4800) munlockall() 14:26:36 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xc96, 0x1, 0x62b0}) 14:26:36 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x2, 0x0) r1 = gettid() msgctl$IPC_SET(r0, 0x1, &(0x7f0000000280)={{0x1, 0xee00, 0x0, 0xee01, 0xee00, 0x15, 0x800}, 0x0, 0x0, 0x5, 0x3, 0xfffffffffffffff7, 0x5, 0x3f, 0xffff, 0x7f, 0x3, r1}) sendmsg$AUDIT_TTY_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f8, 0x2, 0x70bd27, 0x25dfdbfe, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xe94}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000040}, 0x24004094) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x8000) 14:26:36 executing program 4: msgctl$MSG_STAT_ANY(0xffffffffffffffff, 0xd, &(0x7f00000002c0)=""/83) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0xd894, 0xd9, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)={r1}) 14:26:36 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:36 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) socketpair(0x15, 0x4, 0x2, &(0x7f00000006c0)={0xffffffffffffffff}) r3 = syz_open_dev$usbfs(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x2, 0x115400) ioctl$USBDEVFS_CLAIM_PORT(r3, 0x80045518, &(0x7f00000001c0)=0x1) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000300)={0x60, 0x30, 0x7fff, 0x401, 0xfd, 0x81, &(0x7f0000000200)="8465b7a4a03f2046efbbb9a37af9f189fa0d1c75e36e59fd497d2cdefb6a820003fceabbc0d7058a375f58f57354397aac87bb3cc44537fafd8ff0c60bf4b818bc67680ddbab4ea572fb01ffb6ed0c6ebc01c154fcb612b50346d64d01947794e9c172cc29e3081a6c884cb77df1c91df1374eb21d89252a38d156b26abbd3aeec70dc3a2709c535a9813195577ebe8be81f6853e9707efef9fe6d0a436281250f94e6d89de475968bc877bfbff5d82dc46d36d76cb0620a14ac8824e64d06eb1cfa69f8aca0407fd74acb4f913ef5d1a9b808a5630d0c68ad0afef7dc7e6514982de5d7994cdb6d72d251d79f7459b1bdf94af92f298f1ba2441f2198"}) r4 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x401, 0x10800) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000380)={r1}) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) accept$phonet_pipe(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) 14:26:36 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x10000, 0xbc, 0xffff, 0x0, 0x0}) syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00', 0xffffffffffffffff) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x5, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x58d, 0x101, 0x9}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xe, 0x4, 0xd94, 0x10, 0x8, r1, 0x6, [], 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x3}, 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x3, 0x2800, 0x8000, 0x2, 0x906, r4, 0x80000001, [], r5, 0xffffffffffffffff, 0x1, 0x2, 0x1}, 0x40) socket$nl_audit(0x10, 0x3, 0x9) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:36 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xffffffff, 0x8000) ioctl$USBDEVFS_RESET(r1, 0x5514) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:36 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) munlockall() ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) r1 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000040)) recvfrom$phonet(r1, &(0x7f00000000c0)=""/58, 0x3a, 0x100, &(0x7f0000000100)={0x23, 0x0, 0x3, 0x2}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x4, 0x6}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x80800) r4 = syz_open_dev$dri(&(0x7f0000000440)='/dev/dri/card#\x00', 0xc773, 0x200000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000480)={0x10ba00, 0x5f975f96, 0x3}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0xf, &(0x7f0000000800)=ANY=[@ANYBLOB="3d620400040000006ab05000100000005c33300000ff000018390000000000000000000018250000000000006379f9409793a187cb83684044dd0f5f5c3f2b7782395765648b2bcf0c3318b5b99540ddc008e0ee489e6d412de780a30dc8c1288c65b13685349f3e1e196e17c82d0ab44e66917a7f125e41008a", @ANYRES32, @ANYBLOB="000000004f00000018160000", @ANYRES32, @ANYBLOB="000000000000000018160000", @ANYRES32=0x1, @ANYBLOB="0000000000000000ff1f820002000000d540e0fffcffffff18000000030000000000000005000000"], &(0x7f0000000580)='syzkaller\x00', 0xdaee, 0xfe, &(0x7f00000005c0)=""/254, 0x41100, 0x1c, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000700)={0x1, 0xb, 0x7, 0x3ae}, 0x10}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000004c0)='vnet_rx_one\x00', r7}, 0x10) sendmsg$BATADV_CMD_SET_HARDIF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1}, 0x14}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) sendmsg$WG_CMD_GET_DEVICE(r8, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x90, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a='\xa0\\\xa8Ol\x9c\x8e8S\xe2\xfdzp\xae\x0f\xb2\x0f\xa1R`\f\xb0\bE\x17O\b\ao\x8dxC'}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r9}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x44) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x9838a8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r6, 0x800, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x80}]}, 0x34}}, 0x4800) munlockall() 14:26:36 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x3d77, 0x20001) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0x6, 0x42000023, 0xb9, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000380)={r4}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="00010000000000000000080000004c00058008000100657468000700010069620000240002800800030030080000080004000600000008000200ffffff7f0800000c0002a00800210017000000"], 0x60}}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x48, r6, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10001}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80000000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x48890) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f0000000100)={r2}) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_GET_VRING_BASE(r7, 0xc008af12, &(0x7f00000001c0)) r8 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r8, 0xc00464b4, &(0x7f0000000080)={r9}) ioctl$SIOCPNADDRESOURCE(0xffffffffffffffff, 0x89e0, &(0x7f0000000200)=0x7) 14:26:36 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) 14:26:36 executing program 0: getgroups(0x2, &(0x7f0000000200)=[0xee01, 0x0]) r0 = gettid() sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, 0x3e9, 0x20, 0x0, 0x25dfdbfc, {0x30, 0x1, 0x2, r0, 0x80000001, 0xfffffff8, 0x6, 0x4d2, 0x0, 0xc05}, ["", "", "", "", "", "", "", "", "", ""]}, 0x38}, 0x1, 0x0, 0x0, 0x24004850}, 0x800) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:36 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x10001, 0x4, 0xff, 0x0, 0x0}) socket$alg(0x26, 0x5, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) syz_open_dev$dri(0xfffffffffffffffd, 0x7ff, 0x400) 14:26:36 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) munlockall() ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) r1 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000040)) recvfrom$phonet(r1, &(0x7f00000000c0)=""/58, 0x3a, 0x100, &(0x7f0000000100)={0x23, 0x0, 0x3, 0x2}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x4, 0x6}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x80800) r4 = syz_open_dev$dri(&(0x7f0000000440)='/dev/dri/card#\x00', 0xc773, 0x200000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000480)={0x10ba00, 0x5f975f96, 0x3}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0xf, &(0x7f0000000800)=ANY=[@ANYBLOB="3d620400040000006ab05000100000005c33300000ff000018390000000000000000000018250000000000006379f9409793a187cb83684044dd0f5f5c3f2b7782395765648b2bcf0c3318b5b99540ddc008e0ee489e6d412de780a30dc8c1288c65b13685349f3e1e196e17c82d0ab44e66917a7f125e41008a", @ANYRES32, @ANYBLOB="000000004f00000018160000", @ANYRES32, @ANYBLOB="000000000000000018160000", @ANYRES32=0x1, @ANYBLOB="0000000000000000ff1f820002000000d540e0fffcffffff18000000030000000000000005000000"], &(0x7f0000000580)='syzkaller\x00', 0xdaee, 0xfe, &(0x7f00000005c0)=""/254, 0x41100, 0x1c, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000700)={0x1, 0xb, 0x7, 0x3ae}, 0x10}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000004c0)='vnet_rx_one\x00', r7}, 0x10) sendmsg$BATADV_CMD_SET_HARDIF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1}, 0x14}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) sendmsg$WG_CMD_GET_DEVICE(r8, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x90, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a='\xa0\\\xa8Ol\x9c\x8e8S\xe2\xfdzp\xae\x0f\xb2\x0f\xa1R`\f\xb0\bE\x17O\b\ao\x8dxC'}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r9}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x44) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x9838a8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r6, 0x800, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x80}]}, 0x34}}, 0x4800) munlockall() 14:26:37 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x3e1c40) 14:26:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x3e000000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000040)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)="aa294ba6c2515f26bf5eb7252d2d4bbe55aae776d8fab4edf3d615b42e79b34c9bac606c2cf08707a1ed5cb389c6af66b860dbae4fcd7b019508837aabc4d32a791e880e37f42e13285339e125739752b049e210a94f341d9c1da3a5da6aae0ca88299b7f81107ed0e57c31269552fad8817829678baa980799deb0bb0c9f39740951930ea323865b94352fb11f51950714a215afaee8600aa0ef099ae57027fa6f8dff776938072bd4dc24ae4d3037b822c0e3f4bf99a"}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x65c, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@WGDEVICE_A_PEERS={0x600, 0x8, 0x0, 0x1, [{0x148, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @multicast2}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g='\x97\\\x9d\x81\xc9\x83\xc8 \x9e\xe7\x81%K\x89\x9f\x8e\xd9%\xae\x9f\t#\xc20x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)="aa294ba6c2515f26bf5eb7252d2d4bbe55aae776d8fab4edf3d615b42e79b34c9bac606c2cf08707a1ed5cb389c6af66b860dbae4fcd7b019508837aabc4d32a791e880e37f42e13285339e125739752b049e210a94f341d9c1da3a5da6aae0ca88299b7f81107ed0e57c31269552fad8817829678baa980799deb0bb0c9f39740951930ea323865b94352fb11f51950714a215afaee8600aa0ef099ae57027fa6f8dff776938072bd4dc24ae4d3037b822c0e3f4bf99a"}) 14:26:37 executing program 3: setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0xfffffffffffffff7) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0xb1b, 0x80000) mmap$usbfs(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x30, 0xffffffffffffffff, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x6, 0x11ff, 0x5, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x71, 0x101) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x9, 0x0, 0x4d74}) syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x9, 0x100) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000001c0)={0x7, 0xffffffff, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) inotify_init() 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)="aa294ba6c2515f26bf5eb7252d2d4bbe55aae776d8fab4edf3d615b42e79b34c9bac606c2cf08707a1ed5cb389c6af66b860dbae4fcd7b019508837aabc4d32a791e880e37f42e13285339e125739752b049e210a94f341d9c1da3a5da6aae0ca88299b7f81107ed0e57c31269552fad8817829678baa980799deb0bb0c9f39740951930ea323865b94352fb11f51950714a215afaee8600aa0ef099ae57027fa6f8dff776938072bd4dc24ae4d3037b822c0e3f4bf99a"}) 14:26:37 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x4, 0x40000) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f0000000080)={0x200004, &(0x7f0000000200)="f8b7bc8275141d691cf1ee389af9a85a3f734c1faa95397cf1608f67917f6021d5428793cfb716bf87a5c11b1b94603255e73269557927094488f96bfa72b8faca2f815982632161fb6cdc02180ad1dd092bf2c35a3b590216275a736841fd6277842d215a050f5a37d82f9845cce90e2b0aeb6dbf2d2306e354b3a46d687394f9bd1ec4cde05ce10ad30e8b2f08189a77eef08d58e09c2703572f8ad876455490da83a9e5f54d8671481f13a47e8bb69497a03cb3d307008c74947c05c60daca346a1dbf53fe305a0f39dc3ef42216883bd3cd65488705fec2bf63bc3d15850f0c74e5d3e185b90a1d282cf1fecf5ba6beba65b6500000000008c497964edbb0c3c83eff2b7f983af3461a78aade83dc23048d617e3876308bc4777cc447a484c8a9e211586280fb44a3788437914abc5f062d7209a788f2dc89333840ca7ddf08c061180b6800622c88817fd8b4ae543ba8621ae2b9c32e2e42ca15353edb052866bc1037b365b36add5ef3ced87419820f4f2df6b22e3d92cd0b71edf4485bf0b1a40c820b604b8fccea1c4e59b7553306be9584d114ff6cae3a5adf4c12ba87406ebe2d8b8a78129e007941ac0c1a8b5c8f3455843b46a145370440277d5"}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x7fffffff, 0x20000) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f00000003c0)={0xfffffffc, 0x2, "09a75dd600ebdaaa7052838b2c700b73a3ebd86b22fbdd2f27aa5ed26f0a7ea8e732c642a600e40643896856ebe53c426f8300fdbe61a7083d067461aaadf291c8b6c533555b29dec88129e021ac29b408c7933bada7a2c59926789b21b729ba6ce5bdb43abde290653624082c549d266b82d54732b6a7ccbd6f573973407eb2f867e04b9bd479f70907c6964b1b2a332fa3d5f7dc8e404fe7c9504e4984e6ddcc0e7f4a96ec3a5656177a3555d91f974a1b5c34bfa13124b0bfb915898bfcee92c423d85b20a4b8819e38dfdc6e6b82fb1c79bd2ae75482957307a25a4cbe41887db5d419748d34015fdfcbc6dd5f608984a990a84e4d2cba26175c82723dea"}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x4000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)={0x5, 0x5, 0x4, 0x7, 0x0, 0x8, 0x0}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)="aa294ba6c2515f26bf5eb7252d2d4bbe55aae776d8fab4edf3d615b42e79b34c9bac606c2cf08707a1ed5cb389c6af66b860dbae4fcd7b019508837aabc4d32a791e880e37f42e13285339e125739752b049e210a94f341d9c1da3a5da6aae0ca88299b7f81107ed0e57c31269552fad8817829678baa980799deb0bb0c9f39740951930ea323865b94352fb11f51950714a215afaee8600aa0ef099ae57027fa6f8dff776938072bd4dc24ae4d3037b822c0e3f4bf99a"}) 14:26:37 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x3e1c40) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) 14:26:37 executing program 3: socketpair(0x6, 0x0, 0x5, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x820, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4800) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000200)='/dev/dri/card#\x00', 0x800, 0x420000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000080)={r5}) 14:26:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x9, 0x1ff, 0x5, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r5, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x114, r5, 0x400, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "52eb9a092dc1334c149db354e4b3d6e12df820fb8440f314"}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x4}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "fe413209c5eead36180cec1c614ec897b9a52f9a75de972c"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "1bb85e2b9629cea59c491be042a20b428d5f5951f119f69a"}], @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth1_to_bond\x00'}]}, 0x114}, 0x1, 0x0, 0x0, 0x840}, 0x8010) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)="aa294ba6c2515f26bf5eb7252d2d4bbe55aae776d8fab4edf3d615b42e79b34c9bac606c2cf08707a1ed5cb389c6af66b860dbae4fcd7b019508837aabc4d32a791e880e37f42e13285339e125739752b049e210a94f341d9c1da3a5da6aae0ca88299b7f81107ed0e57c31269552fad8817829678baa980799deb0bb0c9f39740951930ea323865b94352fb11f51950714a215afaee8600aa0ef099ae57027fa6f8dff776938072bd4dc24ae4d3037b822c0e3f4bf99a"}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0xffffffff, 0x8001, 0x0, 0x0}) getpeername$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x100000, {0x7f, 0x4a, 0x400, 0x2}}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x38}, 0x1, 0x0, 0x0, 0x20008884}, 0x800) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x401, 0x2e}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) 14:26:37 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x3e1c40) 14:26:37 executing program 3: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x4000000) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x80000000, 0x15f}) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x20, 0x20000) r4 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x7, 0x2400c0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000001c0)={0x0, 0x7, 0x7}) 14:26:37 executing program 5: r0 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x10) accept$phonet_pipe(r0, &(0x7f0000000100), &(0x7f0000000140)=0x10) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000080)={r5}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x101}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x895}, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x3ff, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000280)={0xffffffff, 0x7fff, 0x3, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000300)='/dev/dri/card#\x00', 0x8001, 0x44000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000340)={r3}) 14:26:37 executing program 1: syz_open_dev$dri(0x0, 0xffffffffffffffff, 0x3e1c40) 14:26:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x8, 0x3, 0x4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x19, 0x1, 0x20, 0x6, 0x1108, 0xffffffffffffffff, 0x69, [], 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x1}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0xc, 0x9, 0xffffffff, 0x0, 0x20, r1, 0x1d2, [], 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x1}, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000040)={r2}) 14:26:37 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x54, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3ff}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x401}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x19be}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x24000000}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8000}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x54}, 0x1, 0x0, 0x0, 0x890}, 0x4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x20, 0x20000) r4 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x7, 0x2400c0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000001c0)={0x0, 0x7, 0x7}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4054010}, 0x4000008) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x20, 0x20000) r4 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x7, 0x2400c0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000001c0)={0x0, 0x7, 0x7}) 14:26:37 executing program 1: syz_open_dev$dri(0x0, 0xffffffffffffffff, 0x3e1c40) 14:26:37 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) r3 = syz_open_dev$usbfs(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x7, 0x5410c0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f00000001c0)={0x89, 0x0, "b4ae1ce8561a9b347cf11810ebf027ecdacf3a68c9ee9a00b2768b285d0da28a5d4813186af933b5e761e986fcc1645c0944b579dc69fff19e7a337eb08efe7ed1ad6786757b661866c3d5cf3536919ee3f1b10490455ee9c91c15a9affb52ebea314af14e34a27b55e58ae47483dfe71aa9813f0053d38ae8901b0c35962cb18542552276dfe171e5d7bc6861d18e0cd30f551a8903453761db3c092d2c2f8a68a78980e290f9ab355445dbf59343b969d04b11585c9ae3bd6b079cd750e37b8fb22e130cf66f2cb9dc8f95c6612330bbb89db413856064497d52996795537995297c6d1a11f0d1832fa090584c81ccd880f64bf83b7d1a09dadf7c1a3e1188"}) 14:26:37 executing program 1: syz_open_dev$dri(0x0, 0xffffffffffffffff, 0x3e1c40) 14:26:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24004040}, 0x25) r5 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r5, 0x80045503, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f0000000240)=0xa8) write$nbd(0xffffffffffffffff, &(0x7f0000000040)={0x67446698, 0x0, 0x0, 0x1, 0x2, "795b8ae51479136d02a8db593c62dc61103fe2cd2d0dec1adc52c0d2f1"}, 0x2d) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x20, 0x20000) syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x7, 0x2400c0) 14:26:37 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x3e1c40) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x20, 0x20000) 14:26:37 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x3, 0x80201) r2 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x800, 0x18000) ioctl$USBDEVFS_RELEASEINTERFACE(r2, 0x80045510, &(0x7f00000000c0)=0x1ff) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r3}) ioctl$USBDEVFS_RELEASEINTERFACE(r2, 0x80045510, &(0x7f0000000140)=0x8) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f00000003c0)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000001c0)={0x1, 0x1, &(0x7f0000000100)=""/83, &(0x7f0000000240)=""/210, &(0x7f0000000340)=""/104, 0x100000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r3 = syz_open_dev$dri(&(0x7f0000000400)='/dev/dri/card#\x00', 0x5, 0x246081) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000080)={r2}) 14:26:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) 14:26:37 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) 14:26:37 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:37 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x3e1c40) 14:26:37 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0xb606, 0x4240c0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x20, 0x20000) syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x7, 0x2400c0) 14:26:38 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x3e1c40) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x111800) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x9, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0x6, 0x1ff, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r3}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x3ff, 0x40a803) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xb, 0x7ff, 0x2, 0x80000000, 0x400, 0x1, 0x3, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xc, 0x3, 0x4, 0xa71c, 0x100, r8, 0xfffe0000, [], 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x40) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x0) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x3, 0x80) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000000c0)={0x8, 0x2, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000380)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000300)={r1}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:38 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x0) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x7fff, 0xc900) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) getpeername$unix(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000140)=0x6e) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x0) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f0000000040)={0x3, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000100)) r1 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x5, 0x4002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x6, 0x9, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0x0, 0x7f}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f00000003c0)) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000040)={0x3}) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x840) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) munlockall() 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xb9b5, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x8080) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) socketpair(0x1f, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_RESET(r3, 0x5514) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x7fffffff}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffff}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x4}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4840) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(0xffffffffffffffff, 0x4008af23, &(0x7f0000000200)={0x3, 0x5}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x5c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7f}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8000}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x2}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7fff}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000000) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x400002) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x74, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x15e0}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xa}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2e}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x40}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2b}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x60}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0xa2}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000800}, 0x40) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x2, 0x64e000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x3, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)={r1}) ioctl$USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, &(0x7f0000000040)) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) 14:26:38 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) 14:26:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x10) getsockopt$PNPIPE_INITSTATE(r1, 0x113, 0x4, &(0x7f0000000100), &(0x7f0000000140)=0x4) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000001c0)='threaded\x00', 0x9) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r0 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000380)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:38 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:38 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:38 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000380)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r0 = syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000380)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) 14:26:39 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r0}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r0}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r0}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:39 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:39 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:39 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:39 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r0}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r0}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:40 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r0}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:40 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:40 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 1: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:40 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:40 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:40 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:40 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:41 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:41 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:41 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:41 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:41 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:41 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x0, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x0, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x0, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x0, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x0, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) 14:26:42 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x5, 0x8, 0x6f1}) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x7, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:42 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:42 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:42 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, 0x0) 14:26:43 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1dc, 0x0, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfe}]}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x40e3, @empty, 0x400}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x1, @mcast2, 0x1ff}}}}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8}]}, @TIPC_NLA_MEDIA={0x44, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffff70}]}]}, @TIPC_NLA_NODE={0xa0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "7bc915c84441c5a6f8a26eb1b0968e29e8608249fc7a1ab567d57155b541f5d401639430"}}, @TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "e29027abea2fcaa57487ddae0b158d89751d726f304154e08d2e77975e"}}]}, @TIPC_NLA_MON={0x54, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1fc00}]}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x81}, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xffffffffffffffff, 0x0) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0xffffffff, 0x200}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) msgget$private(0x0, 0x10) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0xffffffff, 0x200}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0xffffffff, 0x200}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x0, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x0, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x1ff, 0x294f, 0x81}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x0, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x0, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x0, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x0, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x0, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r3}) 14:26:43 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 4: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:43 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 4: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, 0x0) 14:26:43 executing program 4: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, 0x0) 14:26:43 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:43 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:43 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, 0x0) 14:26:44 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:44 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:44 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:44 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:44 executing program 5: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 3: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x5, 0x1, "e278fc0e8ef74c4d5a7355bb1f6a942f10b0bfc4fa097b206960f3e58d11e50abbb92018a7bcbedd9c2e533646dd7bf7f6aa75dc664bc77007a7fbba2c0eaf4ad0c36eb75c1b4df133afa2632cc8868071b479963078bfe39c3e10e5944d3d7ecd14cf16265d73d9f09463cf77becb1440da1d893515c8771771cc6b639ed1964184db7e67942d1773842d403a5d7b612e87eebfa6115d57e56a1f40cbb29b620f6606ce30d9615079202105bd1fbb7f1995f02ec31c96eb823591d1161996e420579fb16e2e0447432068ee009aae3f577bf8c71486b2395d21aeadce0f568b26a7c5940dea7c5b77fb544ddb69af22f8e384291bfe423f911baeb5e9f08f6d"}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:44 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r1}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:44 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x20) syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x2, 0x101c00) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0xa0000800) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x1f, 0x9, 0x8}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x2b}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x9}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x50}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008844}, 0x4000000) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) r4 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040)='cgroup.type\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x2, 0x9, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000002c0)={r5}) write$cgroup_type(r4, &(0x7f00000000c0)='threaded\x00', 0x9) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER(r6, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="0000009f0000000000000008", @ANYRES16=0x0, @ANYBLOB="040028bd7000fbdbdf250200000005003500fe000000060028000100000005002f000100000005002d00000000000500300000000000050037000100000008000600", @ANYRES32=0x0, @ANYBLOB="08003a004c030000"], 0x54}, 0x1, 0x0, 0x0, 0x20000800}, 0x20000001) socketpair(0x3, 0x5, 0x3, &(0x7f00000001c0)={0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_VLAN(r7, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xbde}]}, 0x24}}, 0x4c) r8 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r8, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r8, 0xc01064b3, &(0x7f00000000c0)={r9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000440)={r9}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x2000001, 0x62b0}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x3, 0xc001) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x220000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000001c0)={0x77f2cc9f, 0x8, 0x200}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x1000, 0xffffffff, 0x8, 0x0, 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r8, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_MON_PEER_GET(r8, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="64010000", @ANYRES16=0x0, @ANYBLOB="080727bd7000fddbdf25130000004c0007800c000300ec0a00000000000008000200010000000c000400010001000000000008000100707800000c00040020080000000000000c00030004000000000000000800010008000300060000000800030000000000080003000200000008000100ff0300000800020001800000380001802c0004001400010002004e237f00000100000000000000001400020002004e2100000000000000000000000008000300000100004c0006804200040067636d28616573290000000000000000000000000000000000000000000000001a00000017202771a0574643d33dae7cc598b6cc62177bd45721fc19c8c10000040002002c000980080001006f0c00000800020007000000080001006d000000080001000100000008000100040000002400038008000300030000000800010083f2ffff080002004dd900000800030002000000903ad9"], 0x164}, 0x1, 0x0, 0x0, 0x8800}, 0x40080) r9 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x8, 0x40) ioctl$SIOCPNADDRESOURCE(0xffffffffffffffff, 0x89e0, &(0x7f0000000280)=0x10001) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r9, 0xc01064b3, &(0x7f0000000100)={r7}) 14:26:44 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x80000000, 0x9, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x10001, 0x8000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000280)={0xffffffff, 0x8, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:44 executing program 4: socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00022abd7000b99c516edd1fa197bfe29206df250100000005002f000000"], 0x24}, 0x1, 0x0, 0x0, 0x24048001}, 0x20048001) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r0, 0x300, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8811}, 0x10048000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000010000000"], 0x14}}, 0x0) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="ba8dc7d6", @ANYRES16=r3, @ANYBLOB="000224bd7000fddbdf250300000005002e0000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x40000) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x80000000, 0x9, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x10001, 0x8000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000280)={0xffffffff, 0x8, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x2}) 14:26:44 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r1, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x100, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3f}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000001) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x3, 0x0) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x80000000, 0x9, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x10001, 0x8000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000280)={0xffffffff, 0x8, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f00000002c0)={r5}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x2}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 4: socket$alg(0x26, 0x5, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000080)={r2}) 14:26:44 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x2}) 14:26:44 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:44 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x80000000, 0x9, 0x2}) syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x10001, 0x8000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000280)={0xffffffff, 0x8}) 14:26:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x4000000000001000, 0x40000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00', r2) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r4, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x44}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x47}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0xa}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x20008000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000040)={r1}) 14:26:44 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:45 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:45 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f0000000040)=0xe65) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x4100000000006, 0x40e83) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x80000000, 0x9, 0x2}) syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x10001, 0x8000) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x2}) 14:26:45 executing program 4: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7, 0x7fff, 0x6}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x7}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x4010}, 0x8000) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x80000000, 0x9, 0x2}) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x2}) 14:26:45 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:45 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000340)={0x0, 0x3, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000380)={r3}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="976b00000000000000000700000008000100000000000c0099000000800000000000"], 0x28}}, 0x0) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0xcc, r4, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x8, 0x17}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x30}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x19}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffeff}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7ff}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3c}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x147}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}], @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20010000}, 0x48000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x40, r6, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c000}, 0x10) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r7, 0x4004af61, &(0x7f00000000c0)) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r1, 0x400, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x20}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x80) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x2c3, 0x10000) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x24200) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000440)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f00000005c0)={0x24c, r1, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9c}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x408}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffb}]}, @TIPC_NLA_NODE={0x1d4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xd0, 0x3, "18cad8d7c618228196f70e0076070965a3e247ab938d353683c62f74c8e9d468167f1a1f33b3300e06820c71b4bdc942ca2bf3277b56dc16b0446b8bfdf8fc3bd17d79d02ecad634f300af8fb7ba43270c53cbbe6714f03ab8fff1e95b96e6772dd9c30390a777ff6532273ab06ed3a8121dc03b9d2c2716a7bc67af4a7cc599dd30bc2a952e5304ee290abcfa7f1784184e24a9a668e1f91805dbd1dea83f5fc67ca940674987a1cf65e2cc5d1dc0d25c318be09a361327ad5e4b4a9a53012bf67aadb3e68944cb66f317e1"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "096052c2d1d06c6761354a8f758088e3d9bb2032d259860dc0880cfe51e28214e65f5428"}}, @TIPC_NLA_NODE_ID={0x77, 0x3, "c2afe6915a667207d7c4914e888bba5e4eb795a1ab2e81ef9e15556734501db270be94563b7043347bd4cfa115fc41aa1bf382048a07a0e93017c23e8220e0c6ee5f7748c9d8c93d59c8814ab497fcdc8b222a2ef4582217bb5de5b27df40aa7b266598826415a9cdade017a07203dc0a03cde"}, @TIPC_NLA_NODE_ID={0x27, 0x3, "e391edc5ad39ad4a42def0ae6bf2afa2967d811943d446632377151b444dd2737133ab"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x24c}, 0x1, 0x0, 0x0, 0x40040}, 0x20008880) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r4, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0xa0, r4, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x2, 0x38}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0xa0}, 0x1, 0x0, 0x0, 0x81}, 0xc84c) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x2}) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:45 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000040)) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 4 (fault-call:1 fault-nth:0): r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:45 executing program 0 (fault-call:1 fault-nth:0): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x800000000000000, 0x4000) [ 1673.855693] FAULT_INJECTION: forcing a failure. [ 1673.855693] name failslab, interval 1, probability 0, space 0, times 0 [ 1673.914647] CPU: 0 PID: 10783 Comm: syz-executor.4 Not tainted 4.14.225-syzkaller #0 [ 1673.922557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1673.931913] Call Trace: [ 1673.934501] dump_stack+0x1b2/0x281 [ 1673.938125] should_fail.cold+0x10a/0x149 [ 1673.942273] should_failslab+0xd6/0x130 [ 1673.946245] kmem_cache_alloc_trace+0x29a/0x3d0 [ 1673.950914] ion_alloc+0x187/0x810 [ 1673.954459] ? ion_dma_buf_release+0x40/0x40 [ 1673.958866] ? __might_fault+0x177/0x1b0 [ 1673.962924] ion_ioctl+0xea/0x1f0 [ 1673.966391] ? ion_query_heaps+0x360/0x360 [ 1673.970620] ? SyS_write+0x1b7/0x210 [ 1673.974329] ? ion_query_heaps+0x360/0x360 [ 1673.978558] do_vfs_ioctl+0x75a/0xff0 [ 1673.982363] ? ioctl_preallocate+0x1a0/0x1a0 [ 1673.986765] ? lock_downgrade+0x740/0x740 [ 1673.990908] ? __fget+0x225/0x360 [ 1673.994355] ? do_vfs_ioctl+0xff0/0xff0 [ 1673.998324] ? security_file_ioctl+0x83/0xb0 [ 1674.002728] SyS_ioctl+0x7f/0xb0 [ 1674.006103] ? do_vfs_ioctl+0xff0/0xff0 [ 1674.010093] do_syscall_64+0x1d5/0x640 [ 1674.013988] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1674.019182] RIP: 0033:0x465f69 [ 1674.022358] RSP: 002b:00007f45af9f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1674.030055] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1674.037313] RDX: 0000000020000080 RSI: 00000000c0184900 RDI: 0000000000000003 [ 1674.044581] RBP: 00007f45af9f91d0 R08: 0000000000000000 R09: 0000000000000000 [ 1674.051842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x9, 0x183000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000000)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x24, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8085) 14:26:45 executing program 4 (fault-call:1 fault-nth:1): r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x0, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:45 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) [ 1674.059104] R13: 00007ffe52a24ccf R14: 00007f45af9f9300 R15: 0000000000022000 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0)='NLBL_CALIPSO\x00', 0xffffffffffffffff) 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, &(0x7f0000000000)) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x48100, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f0000000080)=0x200) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(r1, 0x4004551e, &(0x7f0000000040)=0x1) ioctl$USBDEVFS_REAPURB(r1, 0x4008550c, &(0x7f00000000c0)) 14:26:45 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:45 executing program 5 (fault-call:1 fault-nth:0): r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x7, 0xaa4, 0x40, 0x3d1d, 0x10, 0xffffffffffffffff, 0x6, [], r1, 0xffffffffffffffff, 0x5, 0x2}, 0x40) 14:26:45 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:45 executing program 4: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0xe0002, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x2}) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r1, 0x0, 0x0) sendmsg$AUDIT_TRIM(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3f6, 0x200, 0x70bd2a, 0x25dfdbfb, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10008080}, 0x404a8c0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x2, 0x35}) [ 1674.253941] FAULT_INJECTION: forcing a failure. [ 1674.253941] name failslab, interval 1, probability 0, space 0, times 0 [ 1674.291134] CPU: 0 PID: 10842 Comm: syz-executor.5 Not tainted 4.14.225-syzkaller #0 [ 1674.299025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1674.308370] Call Trace: [ 1674.310959] dump_stack+0x1b2/0x281 [ 1674.314590] should_fail.cold+0x10a/0x149 [ 1674.318737] should_failslab+0xd6/0x130 [ 1674.322711] kmem_cache_alloc_trace+0x29a/0x3d0 [ 1674.327380] ion_alloc+0x187/0x810 [ 1674.330937] ? ion_dma_buf_release+0x40/0x40 [ 1674.335346] ? __might_fault+0x177/0x1b0 [ 1674.339402] ion_ioctl+0xea/0x1f0 [ 1674.342847] ? ion_query_heaps+0x360/0x360 [ 1674.347077] ? SyS_write+0x1b7/0x210 [ 1674.350790] ? ion_query_heaps+0x360/0x360 [ 1674.355047] do_vfs_ioctl+0x75a/0xff0 [ 1674.358846] ? ioctl_preallocate+0x1a0/0x1a0 [ 1674.363252] ? lock_downgrade+0x740/0x740 [ 1674.367396] ? __fget+0x225/0x360 [ 1674.370838] ? do_vfs_ioctl+0xff0/0xff0 [ 1674.374892] ? security_file_ioctl+0x83/0xb0 [ 1674.379313] SyS_ioctl+0x7f/0xb0 [ 1674.382674] ? do_vfs_ioctl+0xff0/0xff0 [ 1674.386643] do_syscall_64+0x1d5/0x640 [ 1674.390550] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1674.395733] RIP: 0033:0x465f69 14:26:45 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x2000000, 0x6001) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:45 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000001200)={0x470, r2, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc6d69c87}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffff9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x88b3}]}, @TIPC_NLA_BEARER={0x24, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_LINK={0x6c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4ae5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}]}]}, @TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xf4b}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1d}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xac90}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_LINK={0x174, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xacf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x236}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x113}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2e}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa44}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x340e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x439a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}]}, @TIPC_NLA_NODE={0x160, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xa, 0x3, "8673f9bd86f9"}, @TIPC_NLA_NODE_ID={0xd7, 0x3, "651136e7ce3659fdb0930d423237e6cbce0195660fce5462f150f4c5c765b0a21edb85a85bb9e039f862b468b2925ccdda5b4d0ebfd60e8387017d21732472de8427698c3e117381ee12eaf81ff7d349a3f6512ba6c1e86ea38e5d71b2ffadecf31f96b79fcbc4dec27ccd1c6d3968bc2bfd0ab90cf56ea122cf7a2d7c3558a1a1310ac703b6a7c14b3cd6879d9a4c7ad88703c0d1576e0606f9e723e90dd703d7fea91582d4034b27ed27bd7080d64ef9c5143f7536a67874ee160ee6edde2ab8969055bae0b25623712fca7760a3e30bb16b"}, @TIPC_NLA_NODE_ID={0x66, 0x3, "3b6ac01e7d5e8196d0695da747d091470eecef09243680e3c4a508ec956bcc7c7ad4f20a23a1c83c6f4967cc1a8af2295c7310c906df371ad07cffe8db985ba6ba2c087ca8dd6cd1f3220e9c9f2f848afae7d8152338a6514b588953ceec8ef3becb"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fed}]}, @TIPC_NLA_LINK={0x68, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x470}, 0x1, 0x0, 0x0, 0x44000}, 0x4001) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000001c0)={0x2, "9fa231f6807ee5a85b068569316ac12f519d97bcb140cff79e47a8288b27a364514893fdb044c1b374bcefebd396e19d6d433bb6a636e040b0a2e5d6c987d998f1a5d56987b42db9ecda80e2b76be738e382e4fe87a4cab48d06b897a0a4be0367ba4482449e50a73d967aecd414cd27aaf1bd0bf4aa56952a5fc1aeb34ff0f1c87693a658ac7c673bc04fb34c8394e26423e348f50058fc2b80a7f8f88fd0a1859642192a902068b18636a3d4455e39d9dd07c7d3ff5af8eb4a9c4f9a6be7abeda0c2c080356dc8cffe444206d8d102aa268a8668bf1a094b88733f8c80d656f7cc240dabc3eb100463ffaa22c8605081f05e1f07809c4eb0fe9d5ead7ef434ad668c27a169f60f24dd1e50b581f42ca291abdab7f2d6789136e3ebc0a0a82f70ccca3f51661f7dcc68e6f74799e3aecbe1960d4eb57fe26992ac1d0236f842524ac23e3806f047ba5c130226d27ee409b7d2fcd6ba976e81f89294eeb17534c1b17871608c58e073b84bb723aa88502623cfb2c297ffe3fe79672f527724096718ec4a0cc61a14fd02e982571cfba62f0c0affee70565e088557014bf45e1455bf811086572e1d59dea03572dacce3803601eaec2a465cb7b17a57b89a136e8c9acf9eabeb53b44b1185e101e2bcba00dc6d529a8e5a7126381da9127eb3d273511ab552185da8af41a1dc04d45372c80f183487f0eb78467d5e205b3c47ab6c1de289d9817bd1b757c1a0efe2e80bf44c2c49f3ab572c13efa6d8661de2a5572c7c9dc28758b39774019011081a4b49adb02a89552465d009a07687d77824a48743447c8ec3dcfb36314c72511f385f393133c0e0f3a38fefce7f3894081d873aad537bbb62f3750761c4ffafe1c6d1596d2ab13084f7281ce1d6dfc70ed998b9217ff7834a73a0ed643ac53414924ca3cf9281ed07cbb6e3d8b30930b5ed4b047691b41b29423988670f6c322d41963abd08b4500cbc23127640da30de349ec4b845883cd284f2329e4e6b86c1bd6049a5c44802817e130dc03831f1d485319382c5fe17f5963175ec6a2ca66118f6569910b5aa148929573a996bd575d8080b2943c5a8599cfe7c213366ba76208974e5b589337a671b54a65b0cd78ed5acb70dac7f6173272b5732adb037208ccce2b3e55ddc90a43b0ab38e10e75e11176ebb5ced746528c8d0b4c23ee728fa1402a64bc519dd74db9894deca6786cc9feb60d29db6f01781ae4084002dc1aaae321565455134f42959f22264a7df51929c98bf91d1ad505f0e142970c276d9bb2ec76f357666b3054d0b6771bd7667dd0ee107997135c127cae5ff868715bea51d004c4c4c8aaa3bcb1c56c1e167eff30fab1e950d3080756fc99aeb628004576d777adc8720d0fd5961f0c6909029d64d94b18b63167f81fd8f17552d9803923b9370355575fe1c8976375f8bbab6d777671f67e4c86d68ca8cac7438b9f50e0af5156e0b04104d78d4d9cd7a2902bb581291a1dde8c578a135a83ec9928fb21909a73adad29a604800442c640a93dee69705fdbb8540e6dce7b862645a272030a3424cd8edaca627f10ffe86929417f68c80cd41eb95cb9c3984c1b2727b19cb35537df4e303072886a6a1e2d318d72bd0d7ec9e05cb692be9042b7ef228fe42c62214b5367e5aff859b01e9e61a61fe7244fef85361ea36997eb890f6d6a10e41a1e88c15c4b1f6491e948ea59cf952717c08af3fffb29d8f1c06a2a8394861395c4e1904599c5746a861fa3c19bd78ed6efe27fac0be62942625db23dccca5e0159f932ecc625ab099480a1ae30808cc478c5e98ae868498e36a8ccd51f194801c7073a0ec7fde0b66dd526c57bac74f7d52408ff742ebc740608f37894c601c5b93225bfbd339da6699134ec32235de08bf307003104cb32dea8d7c00e977f64cb01144ae972076538dd83c6332497468eaa574eb28c75a57c974a71b09fcab15b447a807e971f8455b50881e322677b4b5f11b0f5b39d537dec26f9ffa8a102eb37d4241d61db9faec89900a96b99eb3977addfe4f0ec1c38229e3fa1d074a385ddb6c2efa7e1564e53e5c95c201e0de58d8a49773f27a494b553953ce0eb7b6ce3ca46959a5bff4c3e5f43ad5e120ca2dfc696467b080b66bd8d4f84785e822e465db000dcac905e49b4200eaaead7986d4545697485936215dc9bf01095419941609d37aa3da59c5d17cc0609db21529a0f3155b4978f6c95d57c4c531422c0572118d51a3dc8ed0f0b80ed6e012a8bfaaa2dcf8625030933116e0feb6a6145d352e8d8c868312b8a544537851975e30787fac7823cdea8b46ce4b6d275fe273efb6c264fda127d1f27762741c8e4df39c0c21a91f1a360eeddf3b373bceb18e878b7c575b7e029be8564d8691900de938bd281ebed51c5e46b1b13b3afceb8c84268425401ec04a15befaf1a9871779497038ca3303d71757ba7661f7555ed33cdcabbffa991c2c1f6e117e9fe5a455d3080e9442a9ea73b60ef27d9c04357f647bc363ed4c819f51f235f7bac9e61b38c7c537a7488295db72e40f2c4f95059c98064ce066eec5c6f9c21272855cc9d316bc710abfe1fb6d0ac4219afa012e2efa906ca1f2d9f10577153cb39f40530033d0efe5ca0169f4cd84b3b6f5b13bee760537a9fc983bae151fe8cbfe3273f6e4b411256aed9f85f736e8f86d07d1d164ff8a838aaa3df89e8813bca5b12303e6f8ae2c3d01b6097cc3c3917821704e97e05a8385b3495db0027016448de2ff8b9bc80b88688f18e840c57cde401f2de75549941163f59ba9e4faafa2e691016f4f4b8098e735f131c7f79dbf3b5e21505aaac2795e289f76ec9cd8ac0b4fef4b37e5953177de9cbe699b8ecd99219714df2b4e3d957403c1a5ac1c509bb05d62cad225b1ceab824c0f3c41f226c28866c1444d0c2dc1f27134e6ef0ba86daa340cf8c62ab244fe19c8d1c92953996e3d6f6131fe83c7efa7e0a6426427fd98926241ed585db1c5febf9a25d684a62e01419ab9ebae9dacf5b73260307c858f440e4d91e01df6046e17283de492497cca5e58ec7e2fbf1b4657d39b0e96a8c5e6c048027a530894bc63ba55e8ab243491389c8bba0ef26f1753a4d53937cb122b9043abb319e5603eafb8162aa1c2108d17224b1d410ed46c60915cda0fb99fda6079167e9ca9c4e7160c5a9216d647c3d44deca869daac53a6e485eab2d76b42f979c4f9874c07dbad286b8a3b92db6ba3926397cd6034ea44fa2c9cb6d2dfc0329d016b9bdb26b4fcdfa907dc1fd7e1880bf0e5fbe4697d3db9c4586c6f33c030f4472423857b68d22b3c4edfe44a56f30692e257d1b20f9867b66d7e26a27cd1b20a1b723ad5e2247caa77e48c785bf64f8d6ef8aea4faf579630bf1bc6df438e9e23b808a0f9004e482f635191e9691eeb47fa5e4efc7808aae99ae6660393b6918cd7a9ccae067f2cd9c3cc5a25653623bdc6b597fa9f9175a963cac5705811e678c2302bff4cb0a9a8775254217623a3f43efc7fb80277ab6499d98a6c59e3d8c39bcc7050a5459fe64ace01e9e64e303c0bc94474dfad3b20bb51abd4072008aee5f73567017375ca65b016f4b9d7dff7743e5fd0a4bc46cf86d3b1d7634ae1bcc27e64874afc1d96cbce4b93409c6ae656137850aafac819099dd8f272d08a3d71aec163174da7800b68dc08d6bf36da64cc3fb6705abd8479dcf30813b883809c1f3901bab27354f8f163b81a820ef9f9075fb7a8f40cc462842ee432d1b005c197afbb437376c89ce7a232e3985f510fd73fb4476f4ef2b63e04d2a8e571866c4a4feb8984ab402331ca3cf9a6c689b956a43aa86aa56f599d557049740ba988e31573e431eeddf3c6bad999f3a09162acff777262b3a160c056a5065f31a5d3af33612a9645f48931a62051d8abbbbf9d80e5ddeef67940c72c7dee7675e56c85051ab0750bc5d30eaabf5ddfdba98e1ce8aaa15ec7193726e2c008e4831185da424acc262ef0dbb7dc8359980cc5ddbfb52a9050c9ce8265bbe19ad1f454b0e251e9c17093f9766e0a1637419b00db2c740bc15f9c52ad821d0b9072fedf5f3549ea98f703613d9793ad3149e1f0669f5ddd516d7c4ec216ed66d1eaa8c8b7bb72af8593848a965ff24774e1d01fb4083f8386dfc90d8f9013b542380aa189578dcce70b242cf10ae364031213a6f3877b396204eb83329d5987582a588dad56a4d682731213b8112304d5324afb247332b4db8a62adf9caa5fe58282768aa03a5ffc5ca921702f2b9bfb3f1973bf4129bbb69d57fe0daff3539d6e35583658c3b8764fab8ca459aec81b402243cab048fa4ac362e6f80987ef2d13448add9ba1c255b4af74e6b9b5858f3bce8c20e058244b2679ac8ca56243667225b98925e006a603047049c844fa23fdb1e002df5672196fc915f4b223211463fe070f80093857f471a0202c486d6d3606a730dbf05ee96dfc69a34ff7ef6f82306b47ecb26a8c96ef4480d0dba2df34cd0fedc300c2daa4dbc9e187f4265180f2f51ce856b46c13e5fc4666b98ea6479127f7db91e0e17948f9e09e402f71c9692afb63c8935fbd559e47496457419571451950d1e4dda9f4774a7d70555e695480c82d42e763852530f85abfd9986b779374fd9c7ed6f04bd485507d552a53587f37633fe253015159322a52c3ee09d6d1eda19c6d3f20a6a12679b1b3605bfabbd2fb07873d69b1412364b7208f681c5bb5ad9318e981eec580eb2306eb83552bc613166bceb086c23fa7086761f12ee1b261333ee5966a997cbb8f22e28a5b08a952310279692c2745df5d19ff121d97e9de0bb34d446504138e5849fbb5671e04d5009d214c5c0a2421172c89ef4e8d46433e5c709933d76bdc8ff450ff7a181e12e19dd9e4e4722fc229589b6a30ffa8e42913c966d810d568377295d535871a4c793a7052b05cd359d9144310e96f94f1409da9378141c0b51fd276eb22fdc0d07bc93e15f29ddd49a2e7a47c6b4fc14c257b546015fe2af99513fc19169029ecd96aef88321ae53386bd864b8ec8b7ae17d602a2b9848207c2c7459391b1a758ee04957042e22239aaff06840aad020527553fe49390decdc39da311dfa6fbef0c8f7592a35ef5ac861e4504f7156df0cfcd0826af947132fba5d6974a643a7619a98e90230ff22b84aa6205ce25b8f14c7bc5dc502531cdce8b2c439cfb338aa06167fcb84cbdc814e884c94287ff5dfa4cc49af8e9af87657e9fafa8d7b32749e56074097ca0afd6b2f202df7cf87484fb0da2f9d82453e43dbc9a724080b11c81073a07f93c1dd6a4a99c7c66630baa63a86cbc53abca494896747c305b475ccd34997c02129b58ff0743fa0fc0c192556e19dfd325d270f367967187381800928e395d5c64e3883c5b8e410e6cbacdbbe3378213b92663f887ef76892b80417794584100cde75e035db7d8aa01783ccbae89e88c60928e08685a05d3da45ec8bda65158ceb9da65c091ba553a4976ee37fc06729af7201b1729d832f78add222ce5a80e1bec3f5e9afad683806d6e359c935324989a4dee5065dc0a121c0798ae4761e7489e8ee5df3499e52a8c6a389e355c23937e1cfff6cd9f5089b16c9c8fc4a5d3891b8eec670cd905b39e6662f7ccb0d863730d2b93c4d0a89cf2976fe6539ca3fb8826ce34fda325b1f8b6469c66d3f1a889566d15a11bb813b63a8ccb00576e175c3f7d237e501c27399a4cc666771e8dea190a9ff815c1821a25e6b39528c0e964e2a0b5d98961a6b612bc9f867"}, 0x1008, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r3, 0x80045518, &(0x7f0000000040)=0x7) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000000)) msgsnd(0x0, &(0x7f0000001680)={0x2, "1f111833be41c06d82d15d48e824f177ae62a40e74a6f4bb804eed659de7c15311ddd7b33963cb9e6607dab31f8cda41ca670f68779dafdde08f9e89d2a0583b7f6ca8777c4325666488f18a00a38733cefe52955eafe347e4023e34145b7fdd63b031281bea387b3f77a57674f78cf2bb6aafa1f97d51698d2118ee48cc654ffff1f14f050aab49278915edb14ae8f487f320"}, 0x9b, 0x800) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x4401, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1674.398917] RSP: 002b:00007fd56e1d1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1674.406617] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1674.413881] RDX: 0000000020000080 RSI: 00000000c0184900 RDI: 0000000000000003 [ 1674.421144] RBP: 00007fd56e1d11d0 R08: 0000000000000000 R09: 0000000000000000 [ 1674.428405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1674.435665] R13: 00007fff80d1552f R14: 00007fd56e1d1300 R15: 0000000000022000 14:26:46 executing program 3: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 0: r0 = semget(0x0, 0x0, 0x600) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002bbd700000dbdf2507000000080001006a0000000c00990001130000560000001400040069703667726574617030000000000000140004006873723000000800000000000000ecfbe53fe94fcfdebf1b0000"], 0x50}, 0x1, 0x0, 0x0, 0x815}, 0x20000001) semctl$SEM_STAT(r0, 0x1, 0x12, &(0x7f0000000040)=""/7) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x101000) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xfffffffffffffffe, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000000)={0x7ff, 0x5, 0x8}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) semget(0x1, 0x1, 0x10) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xfffffffffffffff9, 0x8100) 14:26:46 executing program 5 (fault-call:1 fault-nth:1): r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 3: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00', 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00', r0) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x44, r3, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xffff0001}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x810}, 0x20008000) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x64, r1, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x7f}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x401}, @BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xcb7}]}, 0x64}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xffff, 0x4800, 0x8001}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:46 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x200001, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x80000, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x100000000, 0x0, 0x1}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 3: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:46 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x8e3a, 0x10, 0x0, 0xffffffffffffffff}) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000000c0)=0x5) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000280)={0x7fffffff, 0x2c, 0x1, 0xffffffffffffffff}) r4 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f00000004c0)) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f00000002c0)=0x3) openat$ion(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ion\x00', 0x202, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vhost-vsock\x00', 0x2, 0x0) r5 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000340)=0x10) sendto$phonet(r5, &(0x7f0000000380)="a519398b79e07938325af28e057d791eba72d0b6f9116d1b0f3165b39e064683928843eb2f04c00e9fb3029c3a7a847e8328d5c17bc929d695f61ff784895567f05c492fb06a12d5e749a54a56679de7940cf8f0195111c931a7fcfd8e701835de7df165e8709f00664dfa400531217cadaebac9ffb1badac3f8f8f53e07e5810b0a1371f0fed8d01f0e3ea49c2d3be6d905d3cda4e7a053ac6c4b4d785d", 0x9e, 0x4040040, &(0x7f0000000440)={0x23, 0xb8, 0x0, 0x7}, 0x10) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000100)={0x5, 0x0, "6176c4ccb41a8ece30b70d8455740c598782b1b205709b8559e49be1560667d5b8f7573e73655f37437d152b2d510281c1e833f87e9b94139fd095562d3f89f9bc11bda7d61fef7c5f7425211b4caa7d3723dd35ade9999a34934a6df713315d3df3f65ce3e32721744fdddf7ef997f5d38037587a162db3a76c4ec89d058cdb35f41f9c9b571a0c15a73e3da161e00154ee564248292266ae42f64f10e0f66b5884c66e16427253e74da393b73ff8ed22b9d0c6bb581279e569615b9263bb2596470f7514432a11228a919369aefad40b1e2b903ba3d292cb9405fce234e37f088fd6bd581b2e1d747c49bf12366f2d0eac7bfec294327778d86cf1737ca0f6"}) 14:26:46 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) socketpair(0x22, 0xa, 0x7fffffff, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER_AVC(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="b4000000530401002dbd7000fddbdf25b04c685548b541315baed499fd8555d126b13da75b4fd8714ee61d6c5b3951cafd5e023597d2c463793c336c9cfa53426550eea5c865a763075b898958e6b04b22484a1db9a612fdf288d1afadd1dc2fd2ad8dc42fcaedaf876da17d1d50054d008312d28228c0bfc54fd035824f4a28db8939936ed2aab7dd23a6b2a20e8fd8a3c602985edfbd48347558e46b4a2187ab2236b42b4278e2a2d6a554649475481f30000033169d8d608121fd754a305bfc4adc8cd8cdba926de0f33e482370ca5588f3be43012d4e39670cfb8da97aaeef7883b8905e6acc7631fab242843d813e5e3ae00d242526c546da44ac47c5b9b5fdb1575e821d8a52ceb04bc18ec6e94185437054db4827c619a77b8d09a2a731aac3394fcde411a9253aa940d89d0d57e51e21b742fb7ae50e91a5"], 0xb4}, 0x1, 0x0, 0x0, 0x2006800}, 0x4c045) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:46 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 5: syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00', 0xffffffffffffffff) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$batadv(&(0x7f0000000480)='batadv\x00', r2) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x5c, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xce4d}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r3, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x533}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x200}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040}, 0x20000000) 14:26:46 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x40a, 0x200) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)={0x1a8, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0xd8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x46, 0x4, {'gcm(aes)\x00', 0x1e, "2220193e4a1d96d70163fafb3e80c9dd4f71fe808d3c4422e8e860df76e0"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "4cc661d6a6fcf6d1948f7dd9abf29e91f8683432f6756e"}}, @TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "3e264f5e8bd732e03832c96f00c640e29903940a4bc5353dfe"}}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}]}, @TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}]}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xda4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0x5c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc8f}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3800}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x4000000}, 0x24008841) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x208600) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) munlockall() 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x401, 0x4, 0x1}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x6}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0xc}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040)='wireguard\x00', 0xffffffffffffffff) 14:26:46 executing program 3: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 5: sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x0, 0x0, 0x70bd27, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000011}, 0x40004) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x5, 0x8f, 0x100, 0x80, 0x0, 0xffffffffffffffff, 0xaa, [], 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x2}, 0x40) 14:26:46 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) msgctl$IPC_RMID(0x0, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="690b000000009a1800add2405d00000000"], 0x28}}, 0x0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x4008000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00', r0) sendmsg$NL80211_CMD_SET_MPATH(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r3, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1}, 0x14}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000380)='wireguard\x00', r7) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r4, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r6, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x890}, 0x20000000) r9 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r9, 0x8108551b, 0x0) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:46 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x8, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x108, 0x0, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0x88, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x32d3715a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x76}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x234d8ec4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x18}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1b09178b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf5}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7574788b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x56019316}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x737ca547}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xba}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1a9bea74}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x65a023ab}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ff1d333}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3c7e3a91}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x38, 0xc, 0x0, 0x1, [{0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x61cd}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7a7c2410}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6b8a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb692}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7cd6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8d2a}]}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x240040c4}, 0x1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x200000000000000, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00'}) 14:26:46 executing program 3: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) 14:26:46 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x1c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10004}, 0x44091) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f00000005c0)={0x1, 0x3}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) r4 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x7fffffff, 0x690200) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x9}, 0x9d9e, 0x1217933f454a5261, &(0x7f0000000080)="ad16852de78ea170b38e228d0a8bf519c62c96000de0764ab96feac4c0d433b1ec35f00040e6fdecbc331d04c669d3aecb225cbd3aca5b6d5fcbf106f0058ed38755f10ba488aa758a99193ee3a1519fbeda7b54e937490de8b7aa2bf34f8782ee7668ddb28f6931f53664437f315e39f3f1307978f0e9f6e5efa394501dd885e09ad1a42c6fe8f2600b3b340d1ca02d9a44efce5637e4543800025d5e6bb5b3f0cc06c5e4cf7f610cd78a4d4234444a09efa1405e240816d4ac7d8d6d778b8758bef6cd3be77cae1158dce9f74d5846a3eae44a5bbc76", 0xd7, 0x3, 0x6, 0x38, 0x5, 0x3ca, &(0x7f00000001c0)="9936b2b810b7206fdf9d56a9a2f9d7352e9aa0d1da267d3619e3fe57a553cfcfb43a27dd0a925c4d6312666fdfd9f57253a0e54a2326bb2e1e744de0541409f2782f7b9ce72ab8843160b19d36d4d79eff8008fdd3a4b2df60f7a1355f0a3b14d4cad87ff965dca1b6ac6ea1ef9c223a4108c011e045f15708bd63a6111dc13b972381", [{0xfffffd9c, 0x8}, {0x20, 0xb9, 0x5}, {0x80000000, 0xc5d9, 0x7fff}, {0x1, 0x800, 0x6}, {0x8000, 0xff, 0x200}, {0x1ff, 0x81, 0x1000}, {0x4, 0x0, 0x1}, {0x1, 0x9, 0x7}, {0x1, 0x4, 0x6}, {0x4, 0x0, 0x9}, {0xa49b, 0xb6d, 0x10001}, {0x4, 0x0, 0xfffffff8}, {0x8, 0x3cd, 0x5}, {0x2, 0xfffffff9, 0x5}, {0x1, 0x2, 0x400}, {0x80000001, 0x5, 0x9}, {0x40, 0x3, 0x7ff}, {0x101, 0x7f, 0x1}, {0x1, 0x4}, {0x5, 0x0, 0x5}, {0x4, 0x3e97, 0x4}, {0xba5, 0x80, 0x9}, {0x9, 0x7ff, 0x1}, {0x8, 0x8}, {0xffff, 0x5, 0xff}, {0x1, 0x1, 0xc70c}, {0x2, 0x400, 0x9}, {0x200, 0x0, 0x7}, {0x467, 0xc0000000, 0x5}, {0x2, 0x4, 0x20}, {0x55, 0x5, 0x80000000}, {0x7, 0xfffffffa, 0xd466}, {0x173d6954, 0xffff, 0x9b3}, {0x11, 0x8000, 0x2}, {0x3, 0x73, 0x1}, {0x1f, 0x5, 0x4}, {0x3, 0x5, 0x5931}, {0x1, 0x81, 0x7ff}, {0xeda, 0x7, 0xffff}, {0x7f, 0x1, 0x3}, {0xffff7fff, 0x5, 0x7fffffff}, {0x7, 0x0, 0x5}, {0x4d3, 0x200, 0x8}, {0x2, 0x20, 0x3}, {0x0, 0x10000, 0x4}, {0x9, 0x81, 0x5}, {0x9, 0xfae, 0x9d}, {0x3, 0x100, 0x7}, {0x100, 0xabd5, 0x86e9}, {0x8, 0x400, 0x1}, {0x8001, 0x9, 0x4}, {0x4, 0x70c}, {0x7, 0x400, 0x100}, {0xff, 0x468, 0x4}, {0x800, 0x10000, 0xfffff47a}, {0x8, 0x7ff}]}) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:46 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs\x00', 0x1, 0x0) 14:26:46 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) 14:26:46 executing program 4: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f00000000c0)={0x2, 0x2, "2eb95900e888a37a1912bb4737389fcf70e9ceb2d541a1a0c3401197af8186bb7e39b21a086736dd562df939a52290cd1f352e8ee4566a10895483d07bf0ea5040b34f0aa574876b3fda22c637698b7ba4199765da747942df46d364c5942baf59fd8469a04890e06522fb804794fa2e3cfaeb192176e794a4a496419bc037c57cc15b9a7846049dfacb13d9991f402ffc78a58c240ef76af7ba768a0d51ab5fd9e6cb40e55c99fe1fea4099365949c7c08cd226532edd3cf7592204e312637c6e3d4958f75f2fea38541961bec62e57978131a39875e84ec2f8b298a5c83346f0faa23bdf5efb112e859df60eb6afbdb509307904fc2d3ee90468ed391255c3"}) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) 14:26:46 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, 0x0) 14:26:46 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045518, &(0x7f0000000000)=0x8f) r1 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x341802) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) 14:26:46 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x410601, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x0, 0x3, 0x1}) 14:26:46 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x8, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x108, 0x0, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0x88, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x32d3715a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x76}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x234d8ec4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x18}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1b09178b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf5}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7574788b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x56019316}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x737ca547}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xba}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1a9bea74}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x65a023ab}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ff1d333}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3c7e3a91}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x38, 0xc, 0x0, 0x1, [{0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x61cd}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7a7c2410}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6b8a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb692}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7cd6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8d2a}]}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x240040c4}, 0x1) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:46 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, 0x0) 14:26:46 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000080000000c0002800800020000000000"], 0x20}}, 0x0) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r5, 0x400, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x40000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x0, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000400)='NLBL_CALIPSO\x00', 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(r7, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x44, r8, 0x300, 0x70bd2c, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x44}}, 0x400c800) r9 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r9, 0x4008af00, &(0x7f00000003c0)) r10 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_LOG_BASE(r10, 0x4008af04, &(0x7f0000000240)=&(0x7f00000005c0)) 14:26:47 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x100000000, 0x25e801) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000000)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000040)) 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, 0x0) 14:26:47 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x0, 0x1, 0xe168b5e664b6ce7d}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x28, 0x0, 0x8, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x80, 0x3b}}}}, ["", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4008000) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:47 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:47 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x12}) 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, 0x0) 14:26:47 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x100) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:47 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:47 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x210201, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:47 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) socketpair(0x10, 0x1, 0x8, &(0x7f00000001c0)={0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000001100)='TIPC\x00', 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_PORTS(r5, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x1000400}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x1c, r6, 0x20, 0x0, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r6, 0x0, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x20, 0xff, @udp='udp:syz0\x00'}}}, ["", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000044) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r3, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x72}, @NL80211_ATTR_REG_RULES={0x34, 0x22, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x76e}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x9}, @NL80211_ATTR_DFS_CAC_TIME={0x8}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x13}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x5}]}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x24004000}, 0x40) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:47 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:47 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1, 0x4, 0x5}) 14:26:47 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x181983, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x434200, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000100)={0x1, 0x1a}) 14:26:47 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:47 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000040)) 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:47 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = msgget$private(0x0, 0x402) r2 = syz_open_dev$usbfs(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x4a3, 0x4400) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f00000000c0)=0x8) r3 = gettid() r4 = getpid() msgctl$IPC_SET(r1, 0x1, &(0x7f0000000000)={{0x2, 0xee01, 0xee00, 0xffffffffffffffff, 0xee00, 0xc, 0x3}, 0x0, 0x0, 0x200, 0xb, 0x7fffffff, 0x62e, 0x9, 0x80, 0x8, 0x200, r3, r4}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:47 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000021c0)={0x14, r2, 0x1, 0x70bd2d, 0xfffffffe}, 0x14}}, 0x40001) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x14}]}, 0x24}, 0x1, 0x0, 0x0, 0x4084801}, 0x20000000) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:47 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)) 14:26:47 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c01d8c6", @ANYRES16=0x0, @ANYBLOB="080026bd7000fcdbdf250e00000008000300", @ANYRES32=r1, @ANYBLOB="08002c008000000008003c000180000008002b000600000008000300", @ANYRES32=r2, @ANYBLOB="05002f000100000005002f0000000000"], 0x4c}, 0x1, 0x0, 0x0, 0xc000005}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000002, 0x42}) accept4$alg(r0, 0x0, 0x0, 0x40800) 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)) 14:26:47 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x0, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:47 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0xfffffffffffffffc, 0x6}) 14:26:47 executing program 0: socketpair(0x1a, 0x6, 0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x12b4, 0x0, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x2}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_PEERS={0x1270, 0x8, 0x0, 0x1, [{0x398, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x358, 0x9, 0x0, 0x1, [{0xa0, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={[], [], @empty}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x29}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5}}]}, {0xe8, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={[], [], @empty}}, {0x5, 0x3, 0x2}}]}, {0x34, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x39}}, {0x5, 0x3, 0x1}}]}, {0xc4, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x1}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0xe}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, [], 0x1}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x9, @loopback, 0x4}}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x30}}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x2}]}, {0x6c, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x200}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x800, @ipv4={[], [], @local}, 0x214}}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e24, @empty}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x1}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @multicast1}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x20b4}, @WGPEER_A_PROTOCOL_VERSION={0x8}]}, {0x24, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x101, @mcast2, 0xffff78a1}}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "0214c115db15e94b6ba2c75a5b81de2e08d7aa114ea095f85490da6253b366c2"}]}, {0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x841}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x4, @mcast2, 0x1}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x1, @empty, 0x8937}}]}, {0x7b4, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "1ac8eb86d8634b4f0809c5c7da998eae1d8754d340a3171794053a5619788cfd"}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g='\x97\\\x9d\x81\xc9\x83\xc8 \x9e\xe7\x81%K\x89\x9f\x8e\xd9%\xae\x9f\t#\xc20x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:47 executing program 5: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, 0x0, 0x8, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb36}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r0}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xf1f}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x100}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x8041) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) socketpair(0x2b, 0x80000, 0x20f, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_SET_VLAN(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x44, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x28000000}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:47 executing program 1 (fault-call:8 fault-nth:0): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:47 executing program 3: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, &(0x7f0000000000)={0xc4dd, 0x14, [{0x6}, {0x5, 0x1}, {0x9, 0x1}, {0x5, 0x1}, {0x6, 0x1}, {0xf, 0x1}, {0xb, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x9}, {0xd, 0x1}, {0xa}, {0xd, 0x1}, {0x8, 0x1}, {0xc, 0x1}, {0xf, 0x1}, {0xb}, {0xe, 0x1}, {0x7, 0x1}]}) 14:26:47 executing program 4: socketpair(0x26, 0x2, 0xa63f02a, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)=ANY=[@ANYBLOB="29000004", @ANYRES16=r2, @ANYBLOB="0100000000000000000010000000"], 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) socketpair(0x15, 0x4, 0x2, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCPNADDRESOURCE(r4, 0x89e0, &(0x7f0000000240)=0x6) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r2, 0x800, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24004010}, 0x4001) r6 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000280)={'batadv0\x00'}) ioctl$ION_IOC_ALLOC(r6, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x2c, r8, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xa094674a9d9cb3f}, 0x4094) 14:26:47 executing program 3: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) [ 1676.001706] FAULT_INJECTION: forcing a failure. [ 1676.001706] name failslab, interval 1, probability 0, space 0, times 0 [ 1676.045623] CPU: 1 PID: 11122 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1676.053537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1676.062885] Call Trace: [ 1676.065471] dump_stack+0x1b2/0x281 [ 1676.069094] should_fail.cold+0x10a/0x149 [ 1676.073237] should_failslab+0xd6/0x130 [ 1676.077210] kmem_cache_alloc_trace+0x29a/0x3d0 [ 1676.081880] __vgem_gem_create+0x44/0xe0 [ 1676.086030] vgem_gem_dumb_create+0xc5/0x210 [ 1676.090440] drm_mode_create_dumb_ioctl+0x221/0x2b0 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x3, 0x5, 0x80009, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000040)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) [ 1676.095451] ? __drm_printfn_debug+0x70/0x70 [ 1676.099862] drm_ioctl_kernel+0x14c/0x200 [ 1676.104009] drm_ioctl+0x419/0x870 [ 1676.107559] ? __drm_printfn_debug+0x70/0x70 [ 1676.111956] ? drm_getstats+0x20/0x20 [ 1676.115769] ? fsnotify+0x974/0x11b0 [ 1676.119478] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1676.124403] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1676.129451] ? SyS_write+0x1b7/0x210 [ 1676.133159] ? drm_getstats+0x20/0x20 [ 1676.136951] do_vfs_ioctl+0x75a/0xff0 [ 1676.140742] ? ioctl_preallocate+0x1a0/0x1a0 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r5, 0x80045503, 0x0) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x6, 0x0, &(0x7f0000000240)="e75a2cbc64fb616e2923f7be797ba56c33ddda76ef68da9dc19d7b192dc8bdd61a91acc231efee6ad28518d157f08e99fda80d6665ba441fd95efa53fec4e400843e0c24c95182f29b692aaf72366227f39aa4ee66364fd96beb9a5740b483cbb0900c14ae9db5e01f419f56f16518e4572b4267fb3d667cdfddf967f6d68a58cf89e395b9c06975c9218a2b961847e0818109bf7aad58f7d7171100aa1e289afabd86ff0446d8d514eef773ca97f170f6418c9f4ccf5e4ce6784c8656ae4f9c6db2e70e127e401480a544e22b7e337480a8319f012bbfa1591485ae68c7a2de0afd9fdf17dbd51188ed06f29ca35b36461580e7812b7b9e696b6b40c39be91f60726eacd6f6c7e5e5682b2ea9c97fd0a1fae803518f76db6b3bd320b1aa6305bb9aed6df0ec6e1953e297da9767befa34ca13a904b08733ff9dfd4bdfdf7c25ef562a158a9945e4fce17e27bf25d55648067c84d64730939edde2b0f0e1fcff978e09931da6a1ab9c5c0f99c828e06aac8df683cceaa353d24639d76bc99b8929e2c5bb50203c4901ba13442fb2842a0ea21cf304ec75ddaf20450a343ca4b928999c1450733f156f1c757442a8506e1b176cf120f75d7a1e1b76372286c3ff7ac2407a7b99809833bf4ebde430e555ae49b105f15a78faca5d1561f7f7de9624c651c9fd1895bc4e2a246bdfb8bfb7f69b6ece2b10bff03833ce9649ce81eebe2c4c697c9e14513c4512f671dadabae5ef62fb744734ccbcb6d909614a7545e225481e48b053b4b53c46e6d5cc60b62939137d4530a6890262830925d212fa2b90e2b27b9e057d457cafa5b1e50709580c20be4d3802f722edd5badb1bcfbcb175c2e08038b65ab6969b5c2b964e30dd7104f9fbf843624818763c6186fffafc594f2872bb5475d9eb1790c8f963983237492a75943f16a7fc0e110914b208681ac7e64587df1147d9d0b74097649854cc88034a9f4cab000a74b529c57400ff282b1b8ed6d77cbcbd72679c3a6a1a2abd293cb8e2165f752c2645936f88b5df91de6ac55bd0421b5489ab7a3ed760172d85cb7656106dd45f2acf8a0853b9757c9a721504e6d3df30a6992e3a3e782f4acc9839daeafac989cb68a4c176476dcdfe7579b45cb5710199048895bef5ed13c54a490752acc93aebafad78ab6bb3c9182b591b422f76085420ac80085910ab7763ddf63d6ee8b1bc73419b04687bc7b8f7b4141de85f4d1b7f845aec70b79a781370f61422958ab74c068e9c0acbcbdff5e66a119744dff20ea4208033c5100254d8f9ee5312d636f66f441e52ef5c4dd3c3bb793bf72624ce37de6bfa0fe59f9e2d761b7eee2989c0993d96fc265d60a5a9eb4ae9070fa43cde0930218ef5abf8063229aac2f595de3138c394fdef78795cf42b171a897156f717999757fc85e3573a397f62615ebde81ff800fab442d53fb56b808a49d46c78da776fd0e26ebb6a727e04ef5567c81ff13ab93b70c54832b9721eb91746b0998a1725911ed2f0cff2af2612876390fc662be3bb3fdcc262dfc4a0d6eea6ca686c30a1062298443c180b7b62459f9eee2e6fc6855c15f301f2477ab3faa82e4e1b55ea57dec22d3ee9e1da9f38567dc9f99fce9500b9c0c4c4abc95edc708c196745c543de4825268cf314f9c8e917e1b71aabc4a7c27df2de7634d0c27ce8dc764d775e0f1b9a0cc6b29b29cde0ffe9069b1c70d1c61fd7e4d0d1148986b557e76e746e2b575b9eed4d93027e4c05c2dd042d7ade1e1db35ba70395da855dd794d1f5cb4719ed0e9c0ad314299a7a6aaa2001b21fe2ca6a364c805932199f544cb74ccd82b88c748b606c8bfefffd32ecdb7697fcfefd9141ef3ac262bd04038a0c647764ad7d2b4819e84be05cda1f223ff7b76f89974ba034cb7b9b32decfd3c74311400b5319734d98ff01bd31d3bb26a51ea195ad4822ebebab08deced92da69f1152f54fcdecec11037f624defc463c2b856533be19b9f53db383ddf1288ef8de25a4a02c816707404498b1d05c5d2f88f5c09a24069bb6a1d4ee89598ea102b563b0ba074304d5ee68c36bd83e1dec93e1706d0af2aae12e9444c655ad67652b7e8e53616eb06655bcbd68d44f3f1393f4d213dc5af849273f48cf1264311c93d7d32f717a2aebad9ccd1f5a2f6e6c052191bdda988d802f938f7d259d6a530e651bd104086b43aa9e3f3b2ddeb49ddaa2d286177bf75687c2f3bdd06620d6a6c42f5042fbbecb1305840ee3cc61f0954efde097257603471bc3754f2b8b996f33c52e0d2841f972cd9591bfdc7d4c1f753164a0984f3d7e2d46d350c4a2af7888d5cff20c726db4113d1febf13e7e210d79b2709400aa6284a30fbd706eaf4e18a46232e91c2b1da3fc939463e6baaccbf1dade28cb64762ab14f38a3566d81a27a145ba4be41dafbcecd7c308b096876c2f0d92bcaa00598ebb84d9d9cb36a8014445ba90044d4b40c2165efaa40c5370a9a9fac1b56542cc58f0f489b83417887248cab9c37d5a5c0c6da840eed571fffb25d58ed77f7c56b4ad6cef6d45d06db328a35b2401cfda38e1d8f4f21501ac7094f51057c9c430984a994b5fb7090189c64fc55277e6c935febb0b8f88488a60a85fd6be818cb6b518820ebceb516eddeda67c2a745d0c37a2fe13ba6cb6d607bd171e0478ca4579ad68b413a243afdf8ad66af17ed5e1d19f22e7c1c1f4868aee410f02e93efe17d489cc785e47bd54c66f2229558685244f1e16fda2636a2292c3635c3d4d0c1d980d0d817cebd71336202f25b64820dde8afb0da8579afd5ea68a63790268e8bc5046aa7c2e97dbbfdf97fcdae80bcdbaa483d9b838dfc3c26e059e3e086891fd59e4e8787679d7371bf6b35baafcdea5db5c6824891212ab2b18523e0cc42f1a558b96c45117ca06f5622edbd0cb214388e4bb9ac5cd63d6352516e0d461c3f93b74f47aafee6e38680fc76b3949abddc3d8a849f052b3f4f76d358c56c73ba5b41cdd4cd057b81774a0e90984d5dab570e68ce0e046c4b86767e7f24ad55df9078a343a1bd73e74743cc59ae5cbdf75699b192bdcf6c11574a4bd26dae10bfd80230512d04e98ab9a92dc132417fec549ba8d6cc4e25c7c61ecf579b12bed91708d7acf1dfb64af516e3fa8817a6281a5fe2ce78d001221cbb1306088ab656e933daa86312d6aff5b18e8178a3f88c4ad9ec4cb79984a4c43d0425f6f8b0b8b2b133327d0ed3206bb7a20abe204fc265130af85346844a55fe76b39866c3c174921c9f9d6f3266e4fe96a3d39db919b5ad0850f3b14089322b0023464cc736ee115a8261ada11bf7f4579fba4d08329e8d5c5c9a1aa78fde483661b87fed8bb166f6bf9c27777409083951b22179e1639c2fa246cc00a15705228d0dee020b18477cad9e7cb894efe29a7f4ffee636b8846bb8454e2e08dc589b951ddef40890a1f9689bbf5832601d9dc3b936e30e7be392b99ab86491ea9067af4de9f7976f635893273b2b136d434844b4a84960d82bc34362c8e67362131b5cc4ce905490cf73841228af8cf887ac92dcea5b5678d0f49b9ce99cc4f004b478c077bbcc1617514a9374ee4b14e7675aac7b1d00d6c8afd596e73166e3ce13df58cb3de7d0739487e42b5abb6b85242cfbb843ac71256da1194c451ccf8a3627c961287f1e1f55cb39706d3d83b2f9aea30227727f2badde0f5eeac7fc50d73725436dddd1ec14e3c3378e194f4a7ef010866a4a4178e83e50bd512a268e2b1a1ef5131e391d0875b3c36d70f779f2df99c0023a9a6401280a75b91be74150a8c66b3e79ee07cb15b62b31b588d8cf4f2ab89bd1461b26986dc7ffa7a83475622f2df13e4f48b85fbe163adbdcf82100fcab954fa6d83166989487b18aebc36cf10a87d9d87b6e6401d6af2eb72e6cc9b882c6e6ed416130537e3907d744591a40eca93458a922219f8574566d1dc5e7ba3f631068beed1e98b93bb569e43f026c6a553409ae75a1b44c32267cc7c89cf7fef35846b2420d57e64e76777f8b2cb7b20e2cdf4bcdd0b4effc3ace5d0caecac1ee73580a6c0c65be15327b88d7efa754bbda24b35d2aede37e557f9e5b96577406d3f1dce5682a4882e418c5fd1656d448dedd5d1785ae83243529bc32ffb8d70fc8cc426dfc26f34ca09cf89d392b61f6f14cf5e663d6ab91b10f3ee00bf6cf9edc064a6365305ebb10fdbf3a88cf17434d373cdac2bfe53b08b0e2862884a80f54da7feafe2cbfb891e1fe862feeffb7ad972386d0e250297693246b126bd8403f5e4334b3b32fdf8c8652c38aa7ad8b5688e6a9fdf0acb09a247407135023fb2417eb62bdda03175ee7d5cd13d0b1d6d373c0521459c3cda9f9b228f4aab6ca2e5fccf1d8699bc0943a98248d6b87538327b9365435077247fd23116816130887fdd3e669b951b3ec3f82d6cc26868e048baa550081540a2a1ae2e2836bc45491a3d389f3121e496223937eb361955bd6468563ca948403ed693cf2f9cf9980b9034aff30d2f39ff3c05fe3fb61e1562de8210ea76d9431d05295a7403c53d3761cf9d3f6c1c0738e01e775064f63ac70c91a2e279dbf770a5a7baf4a0e396185c5207b2b8010106197dcfca41e98c74871e3f49ec1992faf0bd4de20eff13a5111984b90469c6c10b8e4cc317ea9512e462959ebdfe4e4686556a1ee42437ed172ae7f17c4ef5459cf9ad7374141624b6ccf4b21d414dff35609d5cabf65007daba527eaa9e1755794bc1f1afe3190a3aace31f2af19c977c2a661dc10316e40c589ea8ad36f0e498b573e5255c04761311ff586ee2da7210a0469900b8997f6c378c8edb9bd09740e59e44feec1f95e3f19753d404444c629ec3076b254eea2888892bab0e2fb7a6cf569a9abdec65f04d11ab320ce2e6e51cc0eaebd4f55af38542e736582c7ac5829854e95f72df8297a24c1d93f16f32c5d7dcd7a55369e4caf83586f1fa38fd05792061e57173ee3dda52aaea546391ec9dbb57b2d60938bdfdf1b920e39cca8a80d0981e5e28647f8fb223cd84d7b4f99efc2001d865779aa8f894a9af5e2279fde70058691b60e4d713efc00f8043b55c25be050963dcb57ce77e08ca5c0f2dd38c4c9761397a031760a3ad258087c00cf8af33e70eee6de82e4228ea54fca8631098a9b87f6276e86db36840a32be936b8e7550e55e4c93ddcf8a068c8ff6d7183a42e25d0ab7158d22b187660226374d8f05b8ef592a31f1ded900d87e5e4d7a9bfd05d8165cbfddc8c22229f89e7e5d80bcb365c332eb3bd404d3bb6df0289934354b54e0598d54afc770ace18e3badf013e989d1ccb26d36df23a13a86ab11df63d62c7d23af7917dc730c0dccc25061a09e101b89e20e771e4e98079901c53c96d25b49b599864cb0c3df8b624fe94a5d555cff801aeebde3af664f63c49f3e26ad8d5072a7d22c48c1a54f5ed6e9edaa670b57d68979f14f0c628fe038f9e1f3a7990720bff59011103bb195d0fd27b603c82430ecc2bca6a6e310ed49314e34446db71840ca61c907f60aa56c74744d086cfaa5a6864bca8bddd9cd95cbacd0d89c512e97b4b1e36af9e398cca1d7a0426008b0de00360327defbbf46524cc0955c99285c24a1f8a2789b25c02a8acc6c469d9f4749b038d06cb550dcd0b240041496e327722a02acf4c5725ab8a4becc421858227b0e6dd1e4bb3b728a9bb20d47c8ea41f0ae7a24eaca26b621c3335179b406b66a29f9d8ee7902366cfc3f66fe15eda4962e464cbcead3a8b0828ceb81939de30debcf"}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000140)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) [ 1676.145145] ? lock_downgrade+0x740/0x740 [ 1676.149309] ? __fget+0x225/0x360 [ 1676.152761] ? do_vfs_ioctl+0xff0/0xff0 [ 1676.156731] ? security_file_ioctl+0x83/0xb0 [ 1676.161148] SyS_ioctl+0x7f/0xb0 [ 1676.164507] ? do_vfs_ioctl+0xff0/0xff0 [ 1676.168477] do_syscall_64+0x1d5/0x640 [ 1676.172366] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1676.177547] RIP: 0033:0x465f69 [ 1676.180733] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1676.188443] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 14:26:47 executing program 0: r0 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00'}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) 14:26:47 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000003c0)={&(0x7f0000000100)={0x2ac, r2, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MEDIA={0xd0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}, @TIPC_NLA_BEARER={0xd8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x0, @private2, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x240000}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @multicast1}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x517, @ipv4={[], [], @empty}, 0x1000}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x3f, @loopback, 0x8}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6d}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3f}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffff5b6}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8000}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7f}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x40}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff0000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x2ac}, 0x1, 0x0, 0x0, 0x10}, 0x4810) 14:26:47 executing program 0: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r0, 0x0, 0x0) sendmsg$AUDIT_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x100, 0x70bd2b, 0x25dfdbff, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x800}, 0x5) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) [ 1676.195708] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1676.202971] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1676.210236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1676.217499] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:47 executing program 2 (fault-call:7 fault-nth:1): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:47 executing program 3: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:47 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r1, 0x0, 0x0) sendmsg$AUDIT_SET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x220}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x3e9, 0x800, 0x70bd27, 0x25dfdbff, {0x40, 0x1, 0x1, 0x0, 0x200, 0x8000, 0x5, 0x2c7f}, ["", ""]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8c) r2 = syz_open_dev$usbfs(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x180000000000, 0x1) ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f00000001c0)) ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000000)) 14:26:47 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) r5 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000001c0)={'batadv0\x00'}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x4000) 14:26:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000180)={'wg2\x00', 0x0}) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000001800)={0x1e34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x8}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b='\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_PEERS={0x1db0, 0x8, 0x0, 0x1, [{0x2c0, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "ea9801a750295acfe115e467e299b6c05d13c146c7263d94c1fb77c20584573e"}, @WGPEER_A_ALLOWEDIPS={0xb0, 0x9, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x40}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5}}]}]}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x2, @local, 0x4}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x4d6}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @loopback}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x9, @loopback, 0x7f}}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @remote}}, @WGPEER_A_ALLOWEDIPS={0x178, 0x9, 0x0, 0x1, [{0x7c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}]}, {0x4c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x2}}]}, {0xac, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010101}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}]}]}]}, {0x78, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x3}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x1, @private2, 0x2f}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x3, @ipv4={[], [], @private=0xa010100}, 0x3}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg='\xdb\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'}]}, {0x218, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0xcdf}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g='\x97\\\x9d\x81\xc9\x83\xc8 \x9e\xe7\x81%K\x89\x9f\x8e\xd9%\xae\x9f\t#\xc20x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xcbfc, 0x12000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0xd3f, 0x3f, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000140)={r6}) [ 1676.380035] FAULT_INJECTION: forcing a failure. [ 1676.380035] name failslab, interval 1, probability 0, space 0, times 0 [ 1676.427029] CPU: 0 PID: 11166 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1676.435015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1676.444451] Call Trace: [ 1676.447042] dump_stack+0x1b2/0x281 [ 1676.450704] should_fail.cold+0x10a/0x149 [ 1676.454938] should_failslab+0xd6/0x130 [ 1676.458919] kmem_cache_alloc+0x28e/0x3c0 [ 1676.463064] __d_alloc+0x2a/0xa20 [ 1676.466518] __shmem_file_setup.part.0+0xcb/0x3c0 [ 1676.471359] ? fs_reclaim_release+0xd0/0x110 14:26:48 executing program 3: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) [ 1676.475765] ? shmem_create+0x30/0x30 [ 1676.479565] ? __vgem_gem_create+0x44/0xe0 [ 1676.483808] shmem_file_setup+0x4b/0x60 [ 1676.487776] drm_gem_object_init+0x36/0xa0 [ 1676.492002] __vgem_gem_create+0x6a/0xe0 [ 1676.496179] vgem_gem_dumb_create+0xc5/0x210 [ 1676.500585] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1676.505602] ? __drm_printfn_debug+0x70/0x70 [ 1676.510006] drm_ioctl_kernel+0x14c/0x200 [ 1676.514150] drm_ioctl+0x419/0x870 [ 1676.517693] ? __drm_printfn_debug+0x70/0x70 [ 1676.522097] ? drm_getstats+0x20/0x20 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) [ 1676.525899] ? fsnotify+0x974/0x11b0 [ 1676.529695] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1676.534616] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1676.539635] ? SyS_write+0x1b7/0x210 [ 1676.543350] ? drm_getstats+0x20/0x20 [ 1676.547147] do_vfs_ioctl+0x75a/0xff0 [ 1676.550944] ? ioctl_preallocate+0x1a0/0x1a0 [ 1676.555346] ? lock_downgrade+0x740/0x740 [ 1676.559494] ? __fget+0x225/0x360 [ 1676.562943] ? do_vfs_ioctl+0xff0/0xff0 [ 1676.566909] ? security_file_ioctl+0x83/0xb0 [ 1676.571311] SyS_ioctl+0x7f/0xb0 [ 1676.574674] ? do_vfs_ioctl+0xff0/0xff0 [ 1676.578649] do_syscall_64+0x1d5/0x640 [ 1676.582542] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1676.587723] RIP: 0033:0x465f69 [ 1676.590902] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1676.598603] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1676.605869] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1676.613131] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1676.620397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 14:26:48 executing program 2 (fault-call:7 fault-nth:2): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:48 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="44000400", @ANYRES16=0x0, @ANYBLOB="20002dbd7000fcdbdf2503000000050035000700000005002d000000000008003c000300000005002a0001000000080034000200000008000600", @ANYRES32=0x0, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4040008}, 0x2004001) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x156000}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd77d}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}]}, 0x3c}}, 0x40000) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, &(0x7f0000000280)={0x4875, 0x1d, [{0x2, 0x1}, {0xb}, {0x5, 0x1}, {0x2}, {0x7}, {0x3, 0x1}, {0xd, 0x1}, {0x4, 0x1}, {0x7}, {0xa, 0x1}, {0xc, 0x1}, {0xb, 0x1}, {0x6}, {0x0, 0x1}, {0x8}, {0x7, 0x1}, {0x8, 0x1}, {0x8}, {0x9}, {0xf, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x2, 0x1}, {0xf, 0x1}, {0x2, 0x1}, {0x5}, {0x2}, {0x8}]}) 14:26:48 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = msgget(0x0, 0x10) msgctl$MSG_STAT_ANY(r3, 0xd, &(0x7f0000000240)=""/251) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:48 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f00000003c0)) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f00000000c0)=&(0x7f0000000040)) 14:26:48 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x5c, r1, 0x804, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1f}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000c801}, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="02002bbd7000eedbdf250500400005082e0000000000080031007f00000008002c000300000005002f0000000000"], 0x34}, 0x1, 0x0, 0x0, 0x40084}, 0x4080) [ 1676.627660] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x3}) 14:26:48 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f0000000080)={0x7ff, &(0x7f0000000000)="aa6230992930ebf957fe642fe59f2868fea1895e77271bacd15915a12aacdcfd0e2b955d773e364f06d131ed129388f57d0568852890183ad499881f71919fb367ca5438c941e5c752e99ca8794ca52e8b9428af748762"}) [ 1676.724285] FAULT_INJECTION: forcing a failure. [ 1676.724285] name failslab, interval 1, probability 0, space 0, times 0 [ 1676.774539] CPU: 1 PID: 11208 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1676.782446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1676.791785] Call Trace: [ 1676.794368] dump_stack+0x1b2/0x281 [ 1676.797993] should_fail.cold+0x10a/0x149 [ 1676.802137] should_failslab+0xd6/0x130 [ 1676.806107] kmem_cache_alloc+0x28e/0x3c0 [ 1676.810249] ? shmem_destroy_callback+0xa0/0xa0 [ 1676.814918] shmem_alloc_inode+0x18/0x40 [ 1676.818990] ? shmem_destroy_callback+0xa0/0xa0 [ 1676.823652] alloc_inode+0x5d/0x170 [ 1676.827276] new_inode+0x1d/0xf0 [ 1676.830637] shmem_get_inode+0x8b/0x890 [ 1676.834608] __shmem_file_setup.part.0+0x104/0x3c0 [ 1676.839527] ? fs_reclaim_release+0xd0/0x110 [ 1676.843925] ? shmem_create+0x30/0x30 [ 1676.847726] ? __vgem_gem_create+0x44/0xe0 [ 1676.851954] shmem_file_setup+0x4b/0x60 [ 1676.855923] drm_gem_object_init+0x36/0xa0 [ 1676.860157] __vgem_gem_create+0x6a/0xe0 [ 1676.864213] vgem_gem_dumb_create+0xc5/0x210 [ 1676.868618] drm_mode_create_dumb_ioctl+0x221/0x2b0 14:26:48 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x101100, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000100)={0x0, 0xbbd7}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f00000000c0)=0xfffff001) 14:26:48 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x8, 0xffffff01, 0x1162b0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0x80045515, &(0x7f0000000040)={0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:48 executing program 5: ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000040)) openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x2}) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xbc, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x78, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xd963}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x24000880}, 0x24040010) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000140)={0x3, 0x0, "be7401a7b0bf3d4226f2baf3966f5112004ee292382d39155b73672ca66700e23720138405ad0caf9fdffe254ca923e6815ccf7f27504a9f1866fa939dc4888f07bed6b67f482d18c3c896da23eabe13401e68883a32112854702e4fd64b36e3e9163af91fdf61687c75e3bc52455575f8dd898df0d0bbcf47b7777396af51f68327c7a2cf307ce8abcc1d387a52d2999ac04ac57990255f9b812a49ef4a73b9fbb10c87a0debcd30b72110f90156f7d83454d361effc16b09019348804a777037400724c91785e16ff69dc879e8ab8d6897985108b6fad6ae16612ad9fd8a4edb9205345ed53ff0308cab37b20df763a00dff9d62961d70de80ae479c496978"}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:48 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x404000) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x9, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r7 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000100)={0x1ff, 0x6, 0x83, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r9}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000000c0)={r8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r2}) [ 1676.873633] ? __drm_printfn_debug+0x70/0x70 [ 1676.878050] drm_ioctl_kernel+0x14c/0x200 [ 1676.882199] drm_ioctl+0x419/0x870 [ 1676.885737] ? __drm_printfn_debug+0x70/0x70 [ 1676.890140] ? drm_getstats+0x20/0x20 [ 1676.893937] ? fsnotify+0x974/0x11b0 [ 1676.897640] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1676.902562] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1676.907693] ? SyS_write+0x1b7/0x210 [ 1676.911419] ? drm_getstats+0x20/0x20 [ 1676.915218] do_vfs_ioctl+0x75a/0xff0 [ 1676.919020] ? ioctl_preallocate+0x1a0/0x1a0 [ 1676.923421] ? lock_downgrade+0x740/0x740 [ 1676.927568] ? __fget+0x225/0x360 [ 1676.931101] ? do_vfs_ioctl+0xff0/0xff0 [ 1676.935082] ? security_file_ioctl+0x83/0xb0 [ 1676.939484] SyS_ioctl+0x7f/0xb0 [ 1676.942843] ? do_vfs_ioctl+0xff0/0xff0 [ 1676.946813] do_syscall_64+0x1d5/0x640 [ 1676.950690] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1676.955855] RIP: 0033:0x465f69 [ 1676.959021] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1676.966706] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 14:26:48 executing program 2 (fault-call:7 fault-nth:3): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:48 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) write$khugepaged_scan(0xffffffffffffffff, &(0x7f00000000c0)='1000000\x00', 0x8) 14:26:48 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x480781) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x9, 0x2, 0x800}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x4009000, 0x9, 0xb, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f0000000280)='/dev/dri/card#\x00', 0x9f, 0x4180) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000002c0)={0xfc3, 0xb9a1, 0x400}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) write$6lowpan_control(0xffffffffffffffff, &(0x7f0000000240)='connect aa:aa:aa:aa:aa:10 2', 0x1b) r7 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x8, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000100)={r3}) write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000140)='1000000\x00', 0x8) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:48 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wg2\x00'}) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) read$usbfs(r1, &(0x7f00000001c0)=""/100, 0x64) 14:26:48 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x3}) [ 1676.973963] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1676.981301] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1676.988547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1676.995794] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:48 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00'}) 14:26:48 executing program 4: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000011c0)='/dev/bus/usb/00#/00#\x00', 0x7f, 0x20002) ioctl$USBDEVFS_CLEAR_HALT(r1, 0x80045515, &(0x7f0000001200)={0x6}) ioctl$USBDEVFS_DISCSIGNAL(r0, 0x8010550e, &(0x7f00000000c0)={0x80000000, &(0x7f0000000140)="366571d20e270b362bdd89cc799c4fef5c9f4df8fb7ab000ca08dda87217be2941980f5bfe401012944dcd451c6064cdf49546cac328b579cb3d3a2799cecf5b189a2b16fe6970c27e6f81ea39643e352dc3d9e295a62dcdf2296e75c7bbfba44037302c401bfb99499889b704f7d4a45536b55a683510b36aa362aae88723bf54b53a72933eeeff1433efcaa51dd87ab335f75c6b9bd076c0218f39856c9e98874cd914298f6d63c1194e78bcb3838747404410162ba06e433c3fb7b52c22b28f02774859f4ccb3cfd92543d1cae66cd70891ca8a233fea2e0cd0c9b6d4442afe2b518151b115c7e52bc79569bdd776bd5c3c0ec6f86e41154b13b712e4159c407bc72f3525c7485c04ccf9150e45ad02069ca24ad3a92c45e9a389af6183b908f25d90b85cff4cc8d17c7cdee163f0693e5faaafa72243c9ba73c8e540803a8ac0979baab1685108cc1c57c25bc9c77040f3cd2be32a15d1fcb6cfc76635f191d4929309a78a158a9688bbb1b7b6ad1b0ee1694a97d5b67ab0df52cb3a1e09bd98ea63368d83b33f1b94f128a4a4e99ccb0d04c91af215c5fa9f14eadf44d76b56a0ccbfeb3424cc7fb712332374691bb38bcd144fdc2b99e59d44edff092e7ecb1643e4f24441fc637c0e79a58a9dd94b211ef746ca2dae156bcb877332f6fc56623c2d6ba728e1987b01d02ae15ae081f0d0aec079125d5e962e43262f5c0160d2a15c7ded2d462f1b00a90fdc92cdcc1527fccb75475915dd4815dd712f79dc1da18a47f4f8c0dfc27116a24b6a677e478c886cd844608a393ea099c1e863c2669da62ac719f8415195901835c1e48db971901067d594940bdca47723ff2ce11201f5361a56f25bc92f6c17569191decd8e0dbaa8551e673efbd370e1f8452a6adfaa5aaa690348f5fbb22f07139e0363ad8bec074ff07a422dbff8ffbd84c7e10c6e39dc708447e5d8792814719b45383572ecb9274e3bf47ece2ec8b4a14bdfcbe910e926c3239da13bc2a35e6433267e78f4a6afe55e0e64969d65de5313beb45de645df619ddf11e85feee62bf3b3cdd8fee2684971d1016d6fc268a7ba9519601b233b2bacd652e1c6ad779c4670e8ccfceb316986e7d02dcbc16b9544156f1bc87f44217e59af12fb4a49380aa6a7c5ca32220590a879455acc4a96b9ff983e9d33bd702820a3fc770f7f449fd02d95146bdd650bf8637aa6b5753dabbdef975758c3da618e21ebea242606c8835dd59e62603f96e47891f0d05e84ee6f86eb0d0670279ae41ddc36604b36a5d51986cc9e73247710db3b336a92d3369f0e5ff43e0f1c0dd2058888bf70fd78950cf0994fae6d3a16ad3faf1aa6462ed842ddfd0243bdd7f7a53685dbe3c382b52963bec664d6a37569db5acb61f74e965c0bfca8e6ca795036093a8701aa601887ce4ffb0ada01b2caf02c375a3cccc072b90c22aee701840525e1d8de1c3288aa693d46bc21c8f0c451ebf52b43b28954db113ee894e5946176b7689ab7b6630cb5e6f62d598d4ae02245f247a09b47d4126cf214bb809178a326b5adcb8689ae59b8b0911b065663c92cd411df16402daa8342b20d800ca2725639834253d3b9bb0c9fb1d9b7a9a3ff5d1a9e0223690ea5ca97233f0208fa1bdd5a38ddcb7bf7f2c35167fa60d984b69d1ec30d9c427b434ee696b5750ca1f371f54f1f8da8301ec6c9d3a428ea767cac88eb51107a8a420aef4109376a83c49640ac8513bce5fc855320abfcd2ca15187d210e2d615f840d28caaccb9f2899e36d6a645afc2249124b99600da6102e09f70bc98b6d87c1abbf7f51bfda2bf2059dd29f7501325f723371eadb805233ed96792afbfe71ba53630adfbf6a2c86f549595e6931024982c02346a24a2afedb96bcad756bc0f3fac658ca399e3240112b1d3b53691fd2f5d43c858c81ffe7668f5c6861a0eac97cf3dc3df258382a76a470574fff0d2996b4ab38f550396d33c1cec757c2ef813a51c1303266bb9f4aa653a9a8ca2ed9d7ed9cb4e77b4d55e727f0f1dd64b9952681c18f1b04d6fcc61c6262decad790af2b4ba2aed88647a9e732fbdd7c4087778aa3343249d561a1d28fb3d56d4f28a56a2fd8edb0fb7395f4c59af499a8f203f67abb9019af017663b4c7e346e82b22814c42bda6db5b037541a004685c16872268a633122f99ee79f4835f985d20105a2dba686c19da0dabe40078b7df2f62b6f148e181b6d70fd159fcdf24613081b839ae55284686525640a8f5c63dfff2688b9c97d9536485dd401cc6fd3a0fee05a0597d038f5e776b67e9fbc5232cf5a3bb3d0991a7e1c044ab8ef00b0a27103915a52db7a9231fa2e723e1a4db1e677e4991cc56c6f1d6cd79852a6477d67867aa4e7a138901919146eef07cdd9bcceca81d46601e740a94f3777b8bbd7145b79dc7e67ecd03d0d7fc79a30b745ad26238cbae504adc802c2985ce96384c2729635bddd649327b40d4b21de41219c0c9a931e0e8cbd8cecdd29116eb8c6b446af0db9515d04d1f397151095f8a3611b837c14e5f9a4c505295ce49348722e05ac69090a98fdc22d9cb04fde9db671052636424ec30af1bb930f7bd5eb464838262ee1bab97cf5431df875e3ea96f584c64054d7dc12af4bdbb9ba4170f4f4b8bc99843a7085d5c90a7cc8a4dbee5cf6e575f33a8f694fc4a0bdceb2d259560668e97be5cc594783a6ea78c62c65e8a1b19d40f593e9e6d79015055e4ee5ddf8bc5ecdbf654a187927beff0eb57729cd032e3edad539a2cafcc9a57104fd2700871349f4548850466fc54186555396421f590201fa944a7412f4b79b0340b0f7e9a2d1be8be7d9e4ff48147be18729de85a95c1997593d9cee97d7d4cbeea065c7d90ad2e3db200bfbfaff5cf81b3ed06fa0cdf6c11966a829c4f1be1f03a625d5ae59ad4a64434834e724b89bcffac848ff8d9660b31aeb18da1724d1281d23f2b5114205fc6a4e15424916551b75bfd3ef207caac0d3308f8c3cd466acbf1a48e22ac28d9c5a0355ebf04002d9772b332fcab7240f6d651140665e76ecf3ffc28bfcc4d830340e04b8494cb5d874c52af6f197533d565d1364dcbee924816c3c96efc55e091f5ae21f61692e3e0c66b275cc52f5bda7fc7af41ed2bfa46773c2aafe77c0ccb069399c75f7b3d44762c467bc6462608c9aff5ed60238d66737ac62247ca42c9e68e6511ef54cf9c89580f6684e1d9944b18d41fe5bf9490da4837d5a94a9a06251fbddafa5ae78ad6ae7ac3f0cca34847f3373b3bb240c66b8bcee08aac6fe26e66fc3f5a8f3cc39c9a280935e5b127715d081d0984d6e42810df6dce239887718363ab858566d24a7b710b39dff92e9377726a101ed195224cd8d307d718cc47a4590223587d7c842866dd8247752a173604a7f48c230df23843c3a63b4f62d0a15612ef404e7e21a3614dabfdfc9fbc70d808e24930e00aaf40ca1ab04488074559948c755eea957bc916ecbe80d44eb049c60e26e22e6b8f046a04ce8cb86b2694398fac11cab4ce9c5d58dd110916127085f585119eab04c304d88bdb9e4237568250278117818c4ed67c8669b042e7dfbaf6ddb2ae274f44eb5dd9836127c607c50a3d3130610d2c2482fce5c7b6f1b915eb492c579248e31a083951a7af44474fa190eca5e8601beeff34f116239db175ef8f9a4b4137c843f2f363507765df50db21f774cc83a6a00644b671565b01e0f743706d2fc70c1e3a7792f9ed5326683a92d1bf9c1c58b83f196e824fe3f375e31393dfd9de0d01b2288ba9ad66a95030b18bcf9281311d29b16cfe135e42c85f02c220be4cf5756e0bc3a1811195696e34018bde48a24895c7bd7791ff0927dbf7404f8f239e753fc583200aac6f4ec63bbd54e29e8cafdd44c563097f2cf920fe7b51c7dd8e69abdce051ea62960550530d5df05a73dc790b61417079852270e26f97db4afa4b2c5c175e5e64def54cd9be781a4fac0a1bb9b30328d608f4f10583a96d8bbd13a18fc8eb5b4fb91990288ea383d9c4a9612f411a57a432a8722ef6601faf8363b842fdd7a588aea1c9be2b24a3519e4c25cc88ae684b85c50f70b2d2bc04584feba14bdb911335fb3bdfce471baa8bfdebddbfdaec248f611b7a593d4a6afde265affbdce84b224d041fd62f7a02e842e66350fc07b583b2d40795b4e071ee0040c239de827709c84ec6d40c9c30582e5567395718f37ba68840ca23d7b61caa1fae94041ceb022c7f5874c477f50020bcb4f09b560f5364dae949af8c256133ea2da695045f921c396f7d9df4282b3a66a87c9dc2c26a794e8033170c30258e8cbe946886c90d1198cecd0512a461e709ac30650ea72aec1b2e0829081ebab0d8a7711e29bc1098a102cf38780ae916f0b398dffdcbd5af9fa1c639a747dd9c353cce8352ae2682cff44678ec6e86ffe921f240bf8442a47f7c6d5373e83dfb25a92daf7570118f0241a013dfe829db4cd06801cd4b2820456836608fffc493363c856f1f347430f20720419d6558fd1756c61f799ac012dd9f6a18664346da3649b3c762e6055fd3cc7b62388612f544f7348f398358000cbe3304d4a84e93a6e86127ab3f5bb53859ff66402f6f5cc38d30e3e80f60e53f12384ea385f6b348485d9d01ff5f841566b9db31be428ae5572bbaf34728f11efb903beae99e99452949fdaf572cd9ad4f0b1160af78bb564a3525678ff1e909d81d5c28b01aa0ad8dcc3a117ef6f128d982eac895cd97f49d0a7a9e56b531961c539615067394f2d104824194d12502acffb7941b2357a8967d3efcd8d197653f8b21c2e7b9b25c007f50a49e7a8f7e3df587a220f258b5d9ad56867e65029586ea0e9f9dfbca6a15bbc3518765b949d30bba3a54a926c37757dc1451dce75fe96840f121c8113f142d6ba7283b8ad108c40e6a048f6ca7bef81c13e7ac15cf869e376690d5fd968fd3c6a26e7e93dfda064fae5fa6397166c24e4c3aa17630919749d03e12d40bbf6a192e0a5d64051642b2508bc7dd169945655384b1348cab1b994d1fbe834d1e36ad31fd0f77b7f3082d6b4318f4017f8162f12afdb41a7773e3c87c599869ea4f52106abc70417d9d955229d0d6559d28224965e2d0da72880f1029c8b8c49b320fda3172efa114ba48bf4140d93d6f6fc645ac0e1fa636c30ce7baaab0153dfe04080ae9696532449ec624cec35e8c658df8ce8a96bd8767fda65cd0caff26f8d6129717060564be621889b3ec7d02f4b98f2637045a100db30118f1de6391fba98b3ad4acdba56154ae7721b2333154edf0eacdba063f5c38f6a700b516d46e6d8c2577ae566f9a7e208f6c21ceff91a111cb8fc4fb163b954e72f3dc76f6d5e282c06b937e51d335af293b292ad2dee3b3ef1d3a04702fa9f59666fe26ca60a74b59e38500070d53205f14027a81ad6f308afe1c36ebf7ddd6bad6bfdc63a62ca24ce0360e19deb41237d91c269ace3761704ffc837acb401a49dc191fb33b2a22a9eaf837944eb9cd52b4ad10f0552656032291eb314fa4315edb8603866c1e1e7186bc6fb24824bb607600fb4b626694f9f3f341838f6d4fe0c57c502ac7770beebfb36f40722f9274f4c4670aa1972dc8c8ad2258fbd4698c1ea6bd8284354e604c39b059c7a2ce256f9974e0d0f8815cd23aeb67c7233c68297db2b282f98b6a794cf8fcc7ff58e8ffb58ec32af4ecf1280d35417e391b1c5ad6368ac2e3287684d89807d175eaf799b754cdd3e9345fa8ca7de691c456783a7a3d583e850cef7a"}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000001180)='/dev/bus/usb/00#/00#\x00', 0x8, 0x10000) mmap$usbfs(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, 0x1010, r3, 0x3) r4 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r4, 0x41045508, &(0x7f0000001240)={0x10001, "88eaacc64832570b4fa0d085ae14dcb109973f9003434b6f2b4abf6f3d51002d7874f497b65b847b4b905dd98a70671176b9e0fa6491310da28a4a47aa2c000197cb4335dddd019d92a083aaa5bd997fa364717bff175e32aeab30e9727ee3b8de200aebd3998501a839af4aa4f2864bfd68ba527b0bea28b80e571007baaf87fdd99213e7b9aa5fa6190c06a5ec0974f5387e7f44a9c05f940acc89e1a6202b03f6795e79f06312579a5b1ad1937d07d4988d5079e0ad2c566a0081b928f7f9ef72de1ff5b1651374d85dd4672c4b4078e2bb64f11d59119f35dad9e9b33872ab69b074a58d4a01c7d0fb3e5b6b74984bfb5352e115ae9b1be0ebead28ec5b3"}) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000080)={0x100000003, 0x2}) r5 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_CLAIMINTERFACE(r5, 0x8004550f, &(0x7f0000000040)=0x401) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000001140)=@usbdevfs_connect={0x80000000}) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000001380)={0x2, 0xc, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r6, 0x40086200, &(0x7f00000013c0)=0x4) 14:26:48 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x1b30, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xfffffffffffffffd, 0x101002) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x60, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x17bb40}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3f}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xfffff000}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x100}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4001}, 0x10) 14:26:48 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x1000, 0x2a8df2dcc293cf68, 0x1}) 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x3}) [ 1677.136242] FAULT_INJECTION: forcing a failure. [ 1677.136242] name failslab, interval 1, probability 0, space 0, times 0 [ 1677.165781] CPU: 0 PID: 11250 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1677.173698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1677.183050] Call Trace: [ 1677.185641] dump_stack+0x1b2/0x281 [ 1677.189274] should_fail.cold+0x10a/0x149 [ 1677.193422] should_failslab+0xd6/0x130 [ 1677.197393] kmem_cache_alloc+0x28e/0x3c0 [ 1677.201545] get_empty_filp+0x86/0x3e0 [ 1677.205434] alloc_file+0x23/0x440 [ 1677.208975] __shmem_file_setup.part.0+0x198/0x3c0 [ 1677.213899] ? fs_reclaim_release+0xd0/0x110 [ 1677.218304] ? shmem_create+0x30/0x30 [ 1677.222105] ? __vgem_gem_create+0x44/0xe0 [ 1677.226345] shmem_file_setup+0x4b/0x60 [ 1677.230317] drm_gem_object_init+0x36/0xa0 14:26:48 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xbf, 0x10b201) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r2, &(0x7f0000000240)={0x23, 0x80, 0x9, 0x2}, 0x10) ioctl$USBDEVFS_CLEAR_HALT(r1, 0x80045515, &(0x7f00000000c0)={0xd, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="090226bd7000ffdbdf250d00000008000600", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x8004) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1677.234555] __vgem_gem_create+0x6a/0xe0 [ 1677.238615] vgem_gem_dumb_create+0xc5/0x210 [ 1677.243040] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1677.248066] ? __drm_printfn_debug+0x70/0x70 [ 1677.252473] drm_ioctl_kernel+0x14c/0x200 [ 1677.256620] drm_ioctl+0x419/0x870 [ 1677.260158] ? __drm_printfn_debug+0x70/0x70 [ 1677.264579] ? drm_getstats+0x20/0x20 [ 1677.268377] ? fsnotify+0x974/0x11b0 [ 1677.272087] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1677.277008] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1677.282022] ? SyS_write+0x1b7/0x210 [ 1677.285736] ? drm_getstats+0x20/0x20 [ 1677.289529] do_vfs_ioctl+0x75a/0xff0 [ 1677.293323] ? ioctl_preallocate+0x1a0/0x1a0 [ 1677.297726] ? lock_downgrade+0x740/0x740 [ 1677.301883] ? __fget+0x225/0x360 [ 1677.305376] ? do_vfs_ioctl+0xff0/0xff0 [ 1677.309326] ? security_file_ioctl+0x83/0xb0 [ 1677.313866] SyS_ioctl+0x7f/0xb0 [ 1677.317222] ? do_vfs_ioctl+0xff0/0xff0 [ 1677.321179] do_syscall_64+0x1d5/0x640 [ 1677.325055] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1677.330502] RIP: 0033:0x465f69 14:26:48 executing program 2 (fault-call:7 fault-nth:4): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:48 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:48 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) 14:26:48 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x4, 0x20000) r4 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x1000, 0x20900) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x9004, 0x40003, 0xffd, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:48 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x4, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8080) r1 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x840) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001780)={0x0, 0xfffffffffffffd76}}, 0xa811) syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00', r2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000180)={0x7fffffff, 0x9, 0x8}) [ 1677.333707] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1677.341393] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1677.348644] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1677.355905] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1677.363286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1677.370579] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:49 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2, 0x0, 0xffffffffffffffff}) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000000c0)=0x5) ioctl$USBDEVFS_CLEAR_HALT(r2, 0x80045515, &(0x7f0000000040)={0x7}) socketpair(0x21, 0x5, 0x9, &(0x7f0000000140)) 14:26:49 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:49 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r2, 0x1}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, r2, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffff801}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x2004c0c4}, 0x200000c6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffbff}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7fffffff}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x54}, 0x1, 0x0, 0x0, 0x84}, 0x0) sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x10, 0x3f2, 0x100, 0x70bd2c, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4008050}, 0xc000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) [ 1677.454561] FAULT_INJECTION: forcing a failure. [ 1677.454561] name failslab, interval 1, probability 0, space 0, times 0 [ 1677.508021] CPU: 0 PID: 11285 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1677.515933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1677.525286] Call Trace: [ 1677.527882] dump_stack+0x1b2/0x281 [ 1677.531697] should_fail.cold+0x10a/0x149 [ 1677.535848] should_failslab+0xd6/0x130 [ 1677.539823] kmem_cache_alloc_trace+0x29a/0x3d0 [ 1677.544489] apparmor_file_alloc_security+0x129/0x800 [ 1677.549682] security_file_alloc+0x66/0xa0 [ 1677.553913] ? selinux_is_enabled+0x5/0x50 14:26:49 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000300)='/dev/bus/usb/00#/00#\x00', 0x4e13, 0x101040) ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, &(0x7f0000000340)={0x0, "401a9def476ce73c1cea9ff2dfde11c641db436f5236fb3fe24ddfe0a0b89d4ffae58b764bc6066a8d2267b9c6ece82ab0859795c44c84aaa0199c6524298be0d87956a1a17d028da170bff136dd5eaa3a28de8b71cc6815e2cf4672ec3bc6186b31b0b507b15581b5daa5e923d5cea7bc3598440ff51c79b44d8bb5e6a169a00232eabecf774365013339202b1e7715bba85cd4a60d0d9fc2a54627f5a70fc6a8f3b299529b7933d40e0dd96e71286eba59f5396ab4d36482a4ad993c666bfd732f30f2a9ebb3e7f2a6d10f3d01dc929b979e48c8f1e299340501181053d8db9132407bcbfed7ae2bf2a48b863b69e823ec91489bd02ff703325e76a7160596"}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x9, 0x9f5, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x9, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0xc96, 0x1, 0x80}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000004c0)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xfffffffffffffff7, 0x18480) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x1, 0x300) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x6, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) r7 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f00000002c0)={r6}) sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x10, 0x3f6, 0x300, 0x70bd2b, 0x25dfdbfe, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4048000}, 0x1c273039b7fd66c6) 14:26:49 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x3, 0x319400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) [ 1677.558260] get_empty_filp+0x15c/0x3e0 [ 1677.562239] alloc_file+0x23/0x440 [ 1677.565784] __shmem_file_setup.part.0+0x198/0x3c0 [ 1677.570707] ? fs_reclaim_release+0xd0/0x110 [ 1677.575111] ? shmem_create+0x30/0x30 [ 1677.578911] ? __vgem_gem_create+0x44/0xe0 [ 1677.583256] shmem_file_setup+0x4b/0x60 [ 1677.587234] drm_gem_object_init+0x36/0xa0 [ 1677.591468] __vgem_gem_create+0x6a/0xe0 [ 1677.595666] vgem_gem_dumb_create+0xc5/0x210 [ 1677.600068] drm_mode_create_dumb_ioctl+0x221/0x2b0 14:26:49 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) [ 1677.605080] ? __drm_printfn_debug+0x70/0x70 [ 1677.609483] drm_ioctl_kernel+0x14c/0x200 [ 1677.613633] drm_ioctl+0x419/0x870 [ 1677.617169] ? __drm_printfn_debug+0x70/0x70 [ 1677.621576] ? drm_getstats+0x20/0x20 [ 1677.625383] ? fsnotify+0x974/0x11b0 [ 1677.629093] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1677.634013] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1677.639023] ? SyS_write+0x1b7/0x210 [ 1677.642736] ? drm_getstats+0x20/0x20 [ 1677.646533] do_vfs_ioctl+0x75a/0xff0 [ 1677.650335] ? ioctl_preallocate+0x1a0/0x1a0 [ 1677.654738] ? lock_downgrade+0x740/0x740 14:26:49 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x101100, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000100)={0x0, 0xbbd7}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f00000000c0)=0xfffff001) [ 1677.658892] ? __fget+0x225/0x360 [ 1677.662339] ? do_vfs_ioctl+0xff0/0xff0 [ 1677.666309] ? security_file_ioctl+0x83/0xb0 [ 1677.670711] SyS_ioctl+0x7f/0xb0 [ 1677.674090] ? do_vfs_ioctl+0xff0/0xff0 [ 1677.678062] do_syscall_64+0x1d5/0x640 [ 1677.681952] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1677.687134] RIP: 0033:0x465f69 [ 1677.690315] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1677.698030] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 14:26:49 executing program 2 (fault-call:7 fault-nth:5): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:49 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x101100, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000100)={0x0, 0xbbd7}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f00000000c0)=0xfffff001) 14:26:49 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0xedc, 0x12, 0x1}) 14:26:49 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0xfffffefffffffffc, 0x424000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:49 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) socketpair(0x15, 0x4, 0x2, &(0x7f00000006c0)={0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) getsockopt$PNPIPE_INITSTATE(r1, 0x113, 0x4, &(0x7f0000000040), &(0x7f00000000c0)=0x4) [ 1677.705293] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1677.712692] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1677.719956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1677.727217] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:49 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x1ff, 0x3, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r3}) 14:26:49 executing program 0: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x5c, 0x200000) r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_GETDRIVER(r0, 0x41045508, &(0x7f0000000140)={0x80000000, "8d98f98f6c18133a756b0eccdaeb01aba18bb1fd865506025905880b9d76f08b74aff66e5ce931a49e66366157197199ace4ed0e8420ad34fc0c9211ad113a33790f9dcea44a4a44fac3617c46684eaa8bd3d622734c6673eb477c41bb8076f71b3e346cd5cecdd0da86fb1749cc7ea1bb00647a2e11c6decd89ee05db902c2dff1c4c972b4b5a5cd04262ce28ef5fe5d03b9844f4b6aba1e7e975ad3cc88991f6b92f9394b9854be171c5c6a538e54f82990839a28c4906d07764ff80999c3f498e8b850575d09f1a3b4b3610492bf5e974f225f66776e9220cbdbd25945ffa4d4433018f815b5760f67702854baf28adb125cc20eac3c9f7a969806bea6e17"}) 14:26:49 executing program 4: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x2}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1677.867793] FAULT_INJECTION: forcing a failure. [ 1677.867793] name failslab, interval 1, probability 0, space 0, times 0 [ 1677.879256] CPU: 1 PID: 11326 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1677.887137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1677.896505] Call Trace: [ 1677.899095] dump_stack+0x1b2/0x281 [ 1677.902726] should_fail.cold+0x10a/0x149 [ 1677.906880] should_failslab+0xd6/0x130 [ 1677.910852] kmem_cache_alloc+0x40/0x3c0 [ 1677.914999] radix_tree_node_alloc.constprop.0+0x1b0/0x2f0 [ 1677.920626] idr_get_free_cmn+0x595/0x8d0 [ 1677.924794] idr_alloc_cmn+0xe8/0x1e0 [ 1677.928594] ? __fprop_inc_percpu_max+0x1d0/0x1d0 [ 1677.933434] ? drm_gem_handle_create_tail+0x118/0x330 [ 1677.938625] ? __radix_tree_preload+0x1c3/0x250 [ 1677.943294] drm_gem_handle_create_tail+0x13e/0x330 [ 1677.948307] ? drm_gem_destroy+0xa0/0xa0 [ 1677.952370] vgem_gem_dumb_create+0xe7/0x210 [ 1677.956796] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1677.961809] ? __drm_printfn_debug+0x70/0x70 [ 1677.966252] drm_ioctl_kernel+0x14c/0x200 [ 1677.970401] drm_ioctl+0x419/0x870 [ 1677.973941] ? __drm_printfn_debug+0x70/0x70 [ 1677.978343] ? drm_getstats+0x20/0x20 [ 1677.982145] ? fsnotify+0x974/0x11b0 [ 1677.985847] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1677.990771] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1677.995782] ? SyS_write+0x1b7/0x210 [ 1677.999496] ? drm_getstats+0x20/0x20 [ 1678.003293] do_vfs_ioctl+0x75a/0xff0 [ 1678.007091] ? ioctl_preallocate+0x1a0/0x1a0 [ 1678.011509] ? lock_downgrade+0x740/0x740 14:26:49 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x130, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x50, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x3, @mcast2, 0x10001}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xfffffe01, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xffff2150}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x100}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x81}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xf0a7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffcd3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xffffffff}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x401}]}, @TIPC_NLA_SOCK={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x400}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x130}, 0x1, 0x0, 0x0, 0x800}, 0x20044080) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:49 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x5, 0x2}) 14:26:49 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x2}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:49 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x94, 0x20100) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f00000001c0)=@urb_type_bulk={0x3, {0xa, 0x1}, 0x7b36, 0x4, &(0x7f00000000c0)="98e679560b0e666ccf2d41afef91a685efa9d3415b58352bb5c9", 0x1a, 0x3, 0x78f, 0x10001, 0x401, 0x8, &(0x7f0000000100)="985abeefbe0e536ea057bdb114e8c23337cc63999072d3895fa0379a800b7ac0ef36a76130b17cd24ea5957522958ae8c04d2f39e57f5e8929cda16e2875fb9ff3612c8b77271e9c91f90c678507cb6e3279b5f93a001134c5687ddf8b01cfcca3ea71e2d388d4de3911e057d8abf6935e5744a7ff7f3e0503fb282a54db307e56174d48e4b934bf6a800bb86538ec852217380898152b7900eb62e91787299c2f6b8f8bb8807d82"}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1678.015655] ? __fget+0x225/0x360 [ 1678.019105] ? do_vfs_ioctl+0xff0/0xff0 [ 1678.023075] ? security_file_ioctl+0x83/0xb0 [ 1678.027477] SyS_ioctl+0x7f/0xb0 [ 1678.030835] ? do_vfs_ioctl+0xff0/0xff0 [ 1678.034806] do_syscall_64+0x1d5/0x640 [ 1678.038693] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1678.043873] RIP: 0033:0x465f69 [ 1678.047054] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1678.054759] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 14:26:49 executing program 2 (fault-call:7 fault-nth:6): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:49 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xe85676c8397f7ba5}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x40}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_OPER_CLASS={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4080}, 0x40) 14:26:49 executing program 4: timer_create(0x7, &(0x7f00000001c0)={0x0, 0x35, 0x1}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x1, &(0x7f0000000240)={{0x0, 0x3938700}, {0x77359400}}, &(0x7f0000000280)) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) socketpair(0x3e5b09c6f7bf2b25, 0x800, 0x1, &(0x7f0000000040)={0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r4, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r4, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x49}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x40004}, 0x20004000) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:49 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x2, 0x20000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x20000841}, 0x2001) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00', 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r2, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4303bbb8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0xc}) 14:26:49 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x101100, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000100)={0x0, 0xbbd7}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f00000000c0)=0xfffff001) 14:26:49 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r3, 0x4008af13, &(0x7f0000000140)={0x2, 0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x9, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) [ 1678.062020] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1678.069283] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1678.076546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1678.083803] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:49 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x101100, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000100)={0x0, 0xbbd7}) [ 1678.155076] FAULT_INJECTION: forcing a failure. [ 1678.155076] name failslab, interval 1, probability 0, space 0, times 0 [ 1678.189031] CPU: 1 PID: 11361 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 14:26:49 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_MODE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004010}, 0x1) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r3, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x2c, r4, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfff}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) 14:26:49 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x2, 0xc5ef237d19f30bdc, 0x1}) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000140)) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x7, 0x0, 0x1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f00000000c0)={0x2}) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000280)={0xcc85, 0x40042cc466cc4a4, 0x1}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c7a346245d200000000000000", @ANYRES16=0x0, @ANYBLOB="020025bd7000fedbdf25010000000500330000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20044000}, 0x40) 14:26:49 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x9, 0x1a, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000000c0)=0x5) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1678.196939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1678.206286] Call Trace: [ 1678.208877] dump_stack+0x1b2/0x281 [ 1678.212510] should_fail.cold+0x10a/0x149 [ 1678.216663] should_failslab+0xd6/0x130 [ 1678.220637] kmem_cache_alloc_trace+0x29a/0x3d0 [ 1678.225306] drm_vma_node_allow+0x4e/0x2e0 [ 1678.229542] drm_gem_handle_create_tail+0x1a1/0x330 [ 1678.234561] ? drm_gem_destroy+0xa0/0xa0 [ 1678.238625] vgem_gem_dumb_create+0xe7/0x210 [ 1678.243037] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1678.248054] ? __drm_printfn_debug+0x70/0x70 [ 1678.252458] drm_ioctl_kernel+0x14c/0x200 [ 1678.256604] drm_ioctl+0x419/0x870 [ 1678.260141] ? __drm_printfn_debug+0x70/0x70 [ 1678.264544] ? drm_getstats+0x20/0x20 [ 1678.268343] ? fsnotify+0x974/0x11b0 [ 1678.272047] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 1678.276969] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1678.281979] ? SyS_write+0x1b7/0x210 [ 1678.285701] ? drm_getstats+0x20/0x20 [ 1678.289511] do_vfs_ioctl+0x75a/0xff0 [ 1678.293307] ? ioctl_preallocate+0x1a0/0x1a0 [ 1678.297707] ? lock_downgrade+0x740/0x740 [ 1678.301864] ? __fget+0x225/0x360 14:26:49 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x400c00, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x4, 0x101002) ioctl$USBDEVFS_REAPURB(r1, 0x4008550c, &(0x7f00000000c0)) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:49 executing program 4: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x10000, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0xfffffffd, 0x26}) [ 1678.305317] ? do_vfs_ioctl+0xff0/0xff0 [ 1678.309285] ? security_file_ioctl+0x83/0xb0 [ 1678.313687] SyS_ioctl+0x7f/0xb0 [ 1678.317048] ? do_vfs_ioctl+0xff0/0xff0 [ 1678.321031] do_syscall_64+0x1d5/0x640 [ 1678.324922] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1678.330102] RIP: 0033:0x465f69 [ 1678.333285] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1678.340991] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1678.348256] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1678.355521] RBP: 00007f075074b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1678.362783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1678.370041] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 14:26:50 executing program 2 (fault-call:7 fault-nth:7): r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r3, 0x1}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r3, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x40880) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:50 executing program 4: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x101100, 0x0) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x280, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x2, 0x1, 0x1}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00', r5) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) inotify_init1(0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000600)={&(0x7f00000000c0)={0x518, 0x0, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0xf8, 0xc, 0x0, 0x1, [{0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa29f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x506ccfa9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcc2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2b17}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x34d31c2c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d309a0b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd656}]}, {0x4}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5bfe}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x19f8}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x50cc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5391}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x43a50566}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1c6c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9581}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x32f42ec9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7dc1369}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6fa8729e}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3463}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6938c256}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7c40}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x653b35f0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x30506e5c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9e3a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4021c654}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f1bde35}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x644ad294}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0xa0, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe5}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x15}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x40fac809}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4c10c3f5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x341df8dd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x70}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5554fc}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53731625}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4998e593}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x19}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7fa9c158}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x68}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4e9364c3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x62be6d2b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x525443}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xef}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0xcc, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x580770c1}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x9419772}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x33}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x61d901be}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x8bf7364}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x15}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1f8e620b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1fcfea94}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x664caf0}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x67155ac8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc9f2a6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x33}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x67}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5623c713}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaa}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x3c, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6956ae41}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4cbd022}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5f}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7c94628e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3ed74387}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x6}, {0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MLSCATLST={0xe0, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xead6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x70e6b6ea}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x12144469}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9f91}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7b0f8589}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcac2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6867262b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3e079671}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb3ab}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x70a3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2b2042ec}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x438d72d9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x30bebd9b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2c08089}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x646f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xedc6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb294}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x136d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xb4aee56}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc0fb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1a8d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64ae0ef1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x251a}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6aee}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0x108, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5e0a6bf3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xbf81b8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf9}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x64f69b86}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x714f4e7a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4858a214}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4143ef8a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe4}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x697304b6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x85}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5cc56f0f}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4395be63}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x57}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x58deab1a}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3ded556f}]}, {0x4}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7f7df965}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xd0b23fc}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x9fd8702}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x43}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x40}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x9ffe820}]}]}]}, 0x518}, 0x1, 0x0, 0x0, 0x4040}, 0x4004002) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x3}) 14:26:50 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x200000) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x6b4140) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000001c0)="fe0485398caf7b13db369230729c8e6e54ba985ec8b4656883f6baad2369c751402335e1378be71b335306bdae6322d8f67d18ef4c56dca3262803fdeb21786b3d790a124443446cde835da2c2b8be10fc353c5d878e866814c7c14333971a2e8ac8b3bde9f195c04295d2a127764f197aa2473391ece7a308026bc244f97795595ba4825705ae0ec155b3dcb345a97abab3b35d7de3dbf29bc343d8becfdb63706c516ce686a170561fafdb69fa331d98dc22534c60cd964c7458705b0854", 0xbf) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x33b, 0x5c}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2c0000c1}, 0x20000000) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x8000, 0x20200) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x8, 0xffffffff, 0x9, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000340)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r6, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r6, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6d}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40084}, 0x4800) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x4c4000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x811}, 0x4000012) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0x80045510, &(0x7f0000000100)=0x7ff) r3 = msgget$private(0x0, 0x0) msgrcv(r3, 0x0, 0x0, 0x0, 0x0) msgctl$IPC_RMID(r3, 0x0) r4 = getpid() syz_open_procfs$userns(r4, 0x0) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000040)={{0x1, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x10, 0x1}, 0x0, 0x0, 0x4, 0x69, 0x0, 0x0, 0x1, 0x1, 0x2f46, 0x2, r4, 0xffffffffffffffff}) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f00000000c0)=@usbdevfs_driver={0x3ff, 0x9, &(0x7f00000002c0)="ff28ba6b4b3021cb6647b9868bd095ce4dbbcec22aebd19515eada7ea8fc494b337f15a808ea522d18f75192a26177daf325a0ce775f5e425647de274230389fe56463ebc098cc4b9c12ab240c8298fc374c9023ef0bae39b266c2307dc15f67bc7abd21d19d72aca0c99f6affa44fcc055bef69c05b2ec7bb1a0e923850d9fab2d4fc624380dce327dc16107c7a8f1df45ac694f07ce4773c837579891174"}) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0x80045510, &(0x7f0000000380)=0x354) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000140)) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x400100000000, 0x8, 0x0, 0xffffffffffffffff}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0x1}) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x81) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000100)={0x1, 0x17, 0x1}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000000c0)=0x4) 14:26:50 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r1, &(0x7f0000000280)={&(0x7f00000000c0), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="88000000", @ANYRES16=0x0, @ANYBLOB="000129bd7000fdfca71496f461dd55000300f5797fff852615b29fe5dee5c9289f191666e7d3b1938802", @ANYRES32=r2, @ANYBLOB="0a001a0008021100000000000a001a00ffffffffffff00000a00060008021100000000000a00060008021100000100000a00060008021100000000000a00060008021100000100000a000600ffffffffffff00000a001a0008021100000100000a001a00ffffffffffff0000"], 0x88}, 0x1, 0x0, 0x0, 0x40011}, 0x840) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)={0x4d0, 0x0, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xd8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10b26b9c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5868}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10b6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81ee}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffeffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x20}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER={0x140, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1616753f, @private2={0xfc, 0x2, [], 0x1}, 0xffff5413}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x401, @empty, 0xea0d}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3293}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x408, @empty, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x40, @loopback, 0x54}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7e2, @local, 0x7401}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5b8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}]}, @TIPC_NLA_SOCK={0x78, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6f31582}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x68f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1a}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xbf}]}, @TIPC_NLA_SOCK_ADDR={0x8}]}, @TIPC_NLA_MEDIA={0x68, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xbadc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MEDIA={0x7c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}]}]}, @TIPC_NLA_LINK={0x70, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb08e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x335}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_BEARER={0xb8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x7, @ipv4={[], [], @multicast2}, 0x7fff}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x401, @ipv4={[], [], @private=0xa010102}, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'ip6tnl0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x30000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'ib', 0x3a, 'dummy0\x00'}}]}]}, 0x4d0}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000340)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="ea4ae744563ab8ee3ad1f6c6c9f3b8b1acc66d1f6d3009bacaea122f0506fa75cfc96b7d786c77ff0000d98cddd0cae25f4d48b744813587fec9d02fe25aaf4fed66f18f8b97ac312ed256668f24a779b05e6c05fb912b91449f44c19e8c2894c506c846537914c7c7b8dbf3906813c31a3fc98a1de09a19d5a8f95f6c74a1bff81e4d177989e3618611d598b8fa63326caccf72a8c301000000717b61d684c5060790c51eee50425249e3c8536188ace54bb9945aafd11c7faddb6264dbac7c6b87f4edc62fe4e032ba4e898c82f9d27353272d69139c194d500fd2d738acab9fb106321688d218a5aa823b5488dc3d125b31f41ff3", @ANYRES16=0x0, @ANYRESHEX=r4, @ANYRES16], 0x1d8}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x7, 0x1, 0x83}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:50 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0xb5}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x88001}, 0x4000000) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000200)='/dev/dri/card#\x00', 0x3f, 0x20400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000001c0)={0x6, 0x6, 0x10, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) write$6lowpan_control(r6, &(0x7f0000000140)='connect aa:aa:aa:aa:aa:10 2', 0x1b) 14:26:50 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x82000, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$nbd(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="674466980000000001000000030000005e3a7c982f0487961bd837dfc9a3a44670fc5725c46d89179471226bf55e0f29e0e1b68abdb4f58f5a397ae5bf1bd4b33573ed5b4ea196425a2fd5325b5a9bc2055865545976145a2693ea348f31a3cf9e055c37bf4c2fc18fe10b1fbf16c1176e88cbb2c11438ddeb7a2e94b8645df153a2f9e1d974d598ce92531153f8eed3be8b5976a623a2a0e95c423863a70e3ac89414de7627e1109185b5781e8a0000"], 0xb0) 14:26:50 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r4, 0x41045508, &(0x7f0000000300)={0x80000000, "2bf46b02b07c4b736b7b28b5308cac8d4288ec05025fc6d0cc939142fec5b7c7476a81beeff9084b0acd549cebddec6c37ee9706399f006519f9896e0d356ab398346bf8c54839dc691342b354e3bc66dd05a8519676a365ee68f0f9faee35f5d3259db254250cbeca639eb7185306ba296d426445ef0ef05de12b4d7bba7d3e746e50f31a353d3dd3a6f926291cca9fed13c78f4a613a9212879260287b1b65eadfbb37389e9ec1a3ee38e9012dac3f42df312d428e32dd8963deaa2657bfb4308926113b517102bdc205cdd429f8535fa6071198401074c1f85f9f35afca18cf106a2d3110d8d616482d5426bab510de79d033438b327770ec4ffe45d65ba4"}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r6, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r7, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4140) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="240400024a6111463537ac42c690ef8562b01f4e9ea8cc680f6512f0aab69bf40a3d247f435cc43200c9a35d", @ANYRES16=r8, @ANYBLOB="000129bd7000fcdbdf250e00000008003100060000000500350006000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) 14:26:50 executing program 4: sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x8800) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:50 executing program 0: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x101000, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) 14:26:50 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) read$usbfs(r2, &(0x7f00000001c0)=""/251, 0xfb) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r4, &(0x7f00000014c0)={&(0x7f0000000140), 0xc, &(0x7f0000001480)={&(0x7f00000002c0)={0x11c0, 0x0, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_FRAME={0x409, 0x33, @data_frame={@qos_no_ht={{@type01={{0x0, 0x2, 0x9, 0x0, 0x1, 0x0, 0x1}, {0x40}, @broadcast, @random="f2ed3c814bfa", @broadcast, {0x2, 0x3f}}, {0x0, 0x1, 0x3, 0x0, 0x6}}, {@type10={{0x0, 0x2, 0x9, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x66}, @random="4117d0450048", @broadcast, @initial, {0x1, 0x2}}, {0x5, 0x1, 0x1, 0x1, 0x4}}}, @random="65e3ed437fdccef1aa9b3271dd7fae635319f51181fc88ffbcacd8e36aad8871e56c8d80f6387f78f410bfa51c78b44ecb6fc556c0d441340cc1bffb09e882c2c93af5e7eb5254f86eaa298a0da723c1a4e4ca36f3c973348ace723799eaeb2f03ea767f5c318c1f10542b59cc66d6c6b263457801c250f6e6931508a07b4a80da149c4ad94e9c81be5a392695658fd5eb62987220b778450e7bae5b027393b5b388e8bac2824859d4df4483e42efa31d887e54940db79d5b850058c5febbf959fe98a2e6aea2784c679ca3c4c95bdef2edee9c7c40de1eee3477f1b16fb211d39530c047bda05eeb338f6fd2526bbcafa7ea4859ca9ac945a3d953ae1ced50130e93ec1b7935487d8f549fd06fed9495c19ab425b7ca54838d4377c5adfcd8dd63ab47e86439e09d70d9e18a7ecf2f9899f7a93194ac7a88e83495d9116d7f131c9e838938d57f7b2cbe2f12f678d84ccfe986c9116ff27638ba61cb092145a1b0cfebfcf069338591e8d0cd1346f552f624d1417d72d2f8e40544aa29c6d5bdccec705a317ea4d72556b7492bc964568dcb39a976102a7f2d69bac2ab38a5c70945c6562d0347a37f4e7483caa26c1543792bb221191bdf1c6b3c2e88efbd7c8bd543bda58637d615485373036687645e6d54f16d7516e7c9eee057796bda30b8e0647b9b249633ade089b4488f8384133d49cbe3f8c7f9787318307ba8a1a9dd61e6b3e616c5928b04daf9b36a018e0050696e7cf425f6fb84da749a30202c0a53e192705f9da6c8b06db61001a1957185285c3868b7a7f4a80a0f639f7feb0233cd645459408eefd4079ee225a6011cb70f44c936c0b5c6db7791925b5f367ba4118496008a9c295fc839c5ff66873101e7fbb58064fe53201f7b959a654c1bce2444c9750213f4de570c256eb39cba22587dae44cf70f3250755d147e5f805ec49feceb5971521c60a9544d742f413bca502ed505be48aa2c813228d929abcab7efedaf31a1111d208029bf54ad3a0e3555fe2a4e4a10775d26b27bb6438be131af9db25910c9b5c5846a066ba806a30027fe31f758dfe83a0a0ed83dabc129ed961e0699605edb0b15b102ec62a182205f46b83725aa2d3cac9a5bcc40026b3370810f5409d83af4993c079230e0aa6c032609f4dd21eba71dd7821e546d631cce5fc8753eb27648a6c7b103f17d54a9d880f2d9ee4583372248c3238a494f8d2888a01a4501a66abe77f26f110c12fd9d95efa8407ef911576269eccda2288ea4c25961de5d834aa8e3ac5230f33b4ffb8e133fdfa589aa77869a481d02b4dbb81531dcffc2f2237fddea984b5e19ca55b5ec12bcfcf839113b68a7903c3ffa9a56c10e5fdcd5b6fdb6a17d088c"}}, @NL80211_ATTR_FRAME={0x8d4, 0x33, @data_frame={@no_qos=@type11={{0x0, 0x2, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x6}, @device_b, @device_b, @device_a, {}, @broadcast}, @random="76b5359992e353e510a7afc38b27129ef4a4add9b51ff6befbb7aa35997930656de303d21227d8bb4948d27dd0a7c73f6c30f9aa9ebfe7f126b6706d2ebc2987eca6d0bb608741ffdb0deb470cc6e3fa4f6151cca1c89bbfe73aec4c029f9333d359e9dc049050e675f8caff8afd4e4db4627af52fb64b2c24a28fc915cc84d572587c8344e5f4ad522b4ed4e128dd2440e2daab035330129541221c2edce6039999e1fb59e873a9274b813d396c7a6b3ca492de0005a03213b6be95d452f97cd57031d01ba15abeb6f25d11f392ddcc70575cf63fc56e3d2c66173c1e0dc7d72a1807d0e6d4a089edbdb9e087f3f0f1490461a8417de3de69b36a12ac68470eb63cac24a41707b23738fef1f3d87948639f8f5e455c9a42d3bfd951d5a94792c8b4f85b14c3554bbc2506f44510d65618e899465df4588758fca1e247856c4ba9729ca1b042bf0ff057adc94c17f63495c4e37b7c8a75d71ee1a74ca6e8d2f9ac514db46e23e8fa06a07111f630dc3fcd2e2529df70c3c167844cd3d8c4f2e88abbf4abd6d9234f522e976ceb0173a2adf576d0f0a801c20c1aa08d87577084ebf2e6cc2958fd0892881b1161b214084b5dbd6c45a9769b31c766c63edfd739e32f14a4eb13023dc7035efe13ce6350de3e5dfe734330ff8110543b6e76dc86b01daa8cea7a156acc40a6f6e1a7b83f5ec56124d39baf599e1f9ab8a279166fce349cad075a48399455c6270fa5a158491fe43d61e312a209f8465dcec98f77fe051d98ea3f3c6909ee9d98343b1109ae5fcf2ad716d72eb8a59ec794c1fdc63960a9b9659c702098f956edc9ace75b839ed678de134b22072303dc1613486deaca5d765ed070857fcea53273b887c79d592a02d364e2e3b2b1d50a8b26954922d0003850b72b0d093a021d7aa0035e188466936abecb4a05c39bc52915885f487db0d65831a7dcd0f862ad546b52c0e63dbe8794c518e5437fd41db0f5e5e7623439c2fc958feb93fbc7f0c48c2c8b9b5d25435b363f27e056cc74ca98a4d6a85bc1a1e468f0822bd0e436644c9b1d688bc9ade01a8caaabee5cd4d3c7aa51d83fc1ba0d4644d6a4205dd3251de5531461139db2a78c5cef52eb9a79082177c87befffdebba2c895670a39efac96ffce5afc5c5d597d68d0202abba6fc133c22b530b6ff789fc4eb718525bb84b247ca9b09ea36497bd9d4020c025510ba9e9730c37a90e6c6825a0615f6b58f5cac0c7a29a3d2f9124345581f7bdcba4a507b96b53ec529af9f09b8a51b1b627dad31bc175e2ca93f840aab1c49a2e6ecadd1b52616d529cdbba1b28ce7dd1f4a1e232cf82d61cd08c6be784409962664fe1234f12cab7cc01e85b491ca4d8c34b315885e1932c056f770e0cfa0b4b775b6469008fc1d7e86925577c3b8753e3a51cc1f2bb249e52bfd9dcc5d6b8ed5d186104e57f206dd231f33c600be87e7d0f6ae96ac066384e2759e0ae79cb2fc56c8832805feb0b5e5535f4e50fe69dd59ffb5257a63420fbb24d8e9a379b0cc32461c79e7e6d672c449a876170c635e3b710183da0351aed13ee4852a289fd1f3817b674810447f830f2f9a291ba8f76803bd7c6e245ea389cf7ba163e3c044065ab22a1214e20f631c31e2f154b7edc4f9af4bc18c549c576744a77f3adc1828b70edb757dfa9ccad77e6098e6f68a416f4ca72d042a214cd5dea48fa2fb268d34e981a257fdd152889464aab7c11eee02583d36c5918d6072cf5bbf1df1e3d6578316c0afd15ece603172fd4941b8158d3bac2372bae8c88b55f13deccefd9d83cf7cf684e3f1c2fcf50079b1d6e095b7c3cfd6ebb71ec2669e07e4b0b36dce322ae859a99cf370767166fbac29df87f225a96c6035f0dcc5aa2bc21b970eb4025a77c75ecb3391e6f4bd2007c64bea9bd2e527c700631d7038054bead30eb014b1c23ee7499585765f42584f45852508e38e04fbb8d1db73621a35a324c96e317fad7b4ce0006b1e3786db538f5644d5b5ae86706e5f77333c5c9e9750ca29e7afe002c004f46142d9cacd3abe8f5ff25317c5acc676769eda8a63eef6b028d9a01021beebf0a3a7dbf39b443257d29aaf13257551101497e0b4df87720c6e69990d7cfcee402c692a7576da7f6f9107149a74ec5810e2d90b4ebca0302d65e64261c3f99c88a46a3ee1d81a0c181cc1afc8aa5751ecb78174390910d83bdea8ebb5fc8168773d481a30d2323de820e4ba89018c6af2eae0564007af639e96ce822ea58adfbb82323d6de43859d260802186291144f6302fb25229aedc97d2fbe929d72da42382503738c3d3d2a4045eaa5ec9a26b2c0b238146df0b4c9b4da931e88db5b09d243ac2b3199f807ec82457f910be5c9c244408daff8b20c29c614e9c945de332a920aa546802f68b3b2b6b89e3536ed63346c804f26c0cb211db599b280a2b4a86a53904a60be55fb4e6550e357f6174bf1f483fd75b8939b184c4c1270784b42c467ad208967437061eb55a99d19945a87111aab053f3a826a0e289176f8923e8613aa334b22b729db28e7066ed1ae95d820fcd84d440994d0543511fa828a3744be51ff1cb2ec63d37e5227a8d0ec8e90da3da4dc416133fa4fa7b38d2ea39531b5354894868782cd17ba6a15f72a846d8237a5ab235f7552ffc180a0d0206f2252f2c04008e724f96cabf158f4b678921571be97640a1d72f4703076595dba27c8a7cf208ead38e73529e49c2a68d62cf6684ceb0ad3480239b1e58dbf1ee83190128e1c5d70a5d6f46766395c100a3e125f63f3c11a69fededa9712de9f34d9289215437f232bbf46a5e97e0db07bde8bf6ea7cad453903393d15b1580cd93f7a5239367b2cd0e67334b329667fce869a2196958619d1eb5feb71a9ec5fb88823bdee56ee3529a79b7a836dee5ffc1c2eb9d922a63544c3dc2af2f51debe903976ab12b62b1333fc1868c670b83d3b5500c5a664d89d30d644611f68cd3b3213831ab4cd33a71b533f6f6790e3cd125e6a0ff5ba75cd5f6f323ea03ee8161384bafc9566ca52b904f7a76f5bf9ba88665f383cdd3b6d1a3a4bc6417d0688afa4512a4e265e618592b94990725880bcf9bc912c55a780a111a2f728287d28c0a03d4abc28820db4a2aac5"}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_FRAME={0x491, 0x33, @mgmt_frame=@assoc_req={@wo_ht={{0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x3f}, @broadcast, @device_a, @from_mac=@broadcast, {0x2, 0x50}}, 0x6000, 0x200, {0x0, 0x6, @default_ap_ssid}, @void, @val={0x2d, 0x1a, {0x40, 0x3, 0x5, 0x0, {0x9, 0x2, 0x0, 0x7f, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x6, 0x0, 0x28}}, [{0xdd, 0x8d, "be40704a25e584b627085c1a9bdebbe631de32b8ae76ad43be336da7755947fedd56def1b3cc2e4c029ec2202d1280eddf982cbb27459922523ed0d6ff1857fd55164f98ff6e066d8650046ba479a4005dc5545046ef96537e9fee643a9e05800df11c7aacab9c0f4e46da94ced3511cb843579ad1c300e31b97fdf21fd83cb1bab5d232a3c4474c62702b6531"}, {0xdd, 0x8, "07aeaeef6f4265a9"}, {0xdd, 0xc5, "09b2b8454c4d531ce1b8fc70a24bcc71177461b32d8a26b9bad5e0cfa7046a89bb5cc9c11406867f80a535be13c4b26a87be87be75d3675d69166cf14289fd472d06828ab633b00ff47dc28bcb72dc653d24dce89853acc08e69e65464696e5c7ecb1a4bce73a70daf5e599582fd0cb5b969fe44cb42f0d6d7460d4e26cf9160bdb8ba94ba9d4c7df8b437f9e921a3a150fa0fd3ffa71435c4f0758e1aea94c925747950429d0fea0a79b87f10ce64f5fbea331470661b8708d53bc406332cb5dc09d450e9"}, {0xdd, 0x58, "228b7803196d336c210c55f244ef7582ff48bf09061f43004f622e42835b58813fb1e447bae0b1fec744d9dc33592911ccec2b2ba6859f4d66d24ce78d97482cb4771fe7b6d34329be6b384bfe95ddc5746175f52c337822"}, {0xdd, 0x6e, "735525b24e36e295800cf2c1920cc8116b6bd9362251a2c36b2a3f9b71c831c4cf5794777016ad67460a2b520e28430bccd56d7f8d69e8959065349f7d397dffc8c68f67f43e8eab66ef3d7796a51c43027971025fbf5470f56627adbfe008975c4892eb069fe862a00c32ebf144"}, {0xdd, 0x2a, "d39ca8d5f2f1f68880176d95c2452904e9e05a775e30957055ab940b533daf1b9c3acca0b0a85691f85e"}, {0xdd, 0xe, "d9822ad2b1d666aded59f1eb0e8f"}, {0xdd, 0x36, "c5bb81c79335dc9839bbc14cdadbe17b5354d09bce6736cb770b0ba4e2642d62e31b221c8814a9854b079af9b087fee09cd6324aa8c1"}, {0xdd, 0xc6, "99b2f7890bf1e0774c4453ec9872a40e726655c2a8635d70b859f0b158711ffe8544720e0df0ede9332b987c4d20f9e3789ca4efb4b2e405c32620ac68c616e90fce9a6a00a2747295d7054266df5912113c0d8a5cc1e189571a288a6046655937dc31a6b6f19b302d53ec4921c91e5e536a5ac632f36edd5709fff18305f51383b91992347e67c60d30b0f0551c0bd9a529097919f8c6e5387784ac9d53b47dc2fb5c7daab99e2ec15795a0e8e14484fadac30812d76d887d8e44477cfe0a3dd98f04148f69"}, {0xdd, 0xe5, "6dc387aeacbb3c80c07d6f4dff0b4f7f58cd448be9139122dd65ed2bd6f14f53fbe4d19357ac5a91f6a06d08d8a6b225b93106928d61045bd5feeeac7231f40d3d4ed2b1974bfff8ccdeac6614c63060aec1810e24eba827df99c2e3b4b94fb4a8cf72b1a1302904a587735d701f306d8f841abcff04419e584da2b7f98cc0391c4f317955f24290956de8d1d3ef5c002d1f32f6deff40c9e4803649c7f92c87edf8eefec2bc5b856b5453bf4e080e8553063b7f045e9f6b462cedd2fb04da49313f224325c8613dc2548a5a6543371da1a72106028452e4d07c18a25c0393bba5f6121686"}]}}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x11c0}, 0x1, 0x0, 0x0, 0x4000}, 0x40001) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r5}) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x101, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xe6d, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(r1, 0x4004551e, &(0x7f00000000c0)=0x6) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0)='wireguard\x00', 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00', r1) sendmsg$TIPC_NL_NODE_GET(r3, &(0x7f0000000640)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000340)={0x29c, r4, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_SOCK={0x70, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x646}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x386}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x60f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfc81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8001}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x52}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA={0xa0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x650}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x48000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4383}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x41}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff66ad}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1f}]}]}, 0x29c}}, 0x4048004) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x40, r2, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x2}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x30}]}, 0x40}, 0x1, 0x0, 0x0, 0x44090}, 0x2084) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x90) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x101, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0xfffffff7, 0xfffff801, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f00000000c0)={r1}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) socketpair(0xa, 0x800, 0x1, &(0x7f0000000240)={0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000002c0)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="020427bd7000fcdbdf250a00000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000020) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x7fff, 0x90480) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000100)={0x3f, 0x6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x400, 0x8, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f00000001c0)={r8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:50 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x80, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f0000000000)=0x56b) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000100)) r2 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffe, 0xe2fe9cb96699c814) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r3, 0x4008af13, &(0x7f00000000c0)={0x3, 0x4}) ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, &(0x7f00000001c0)={0x7, "4ef80b6e84438f335f79fe9338c593c7d516030d54a6eb7faffebaadd9f2575426e1d8ce198c07894d24881349f283a5e44991ddbaca459864998f657669d53f26ee2d8cec77851c70f4898b0bee4f3d885fb2fd5697160ca3971f93b6836a191ec4aa8cc0f70d460fc2cc9a241e285f105ff00c493660c157896046314ced431d2d906dc2804dbad35a5c4881d4ce1f8748b4a768bb0bf41d7777908658e2819612d43e025f3139e815bdadcb26154a65497a41e219b1fedc4402a3e1b77fd5f48a41e5468ac0b261ba56e3834d2a47818e3b8c2771b306e964c9522a057b641cb2209c7fba23484df00341b5ddf1343f2e8f0090ddbb4ef65250e183036ca5"}) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, 0x0, 0x101, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) socketpair(0x28, 0x80000, 0x20b3267d, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000140)={'wg0\x00'}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x100000000, 0x2}) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0xfffffffffffffff6, 0x2, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f0000000200)={0x354, 0x0, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xff}]}, @TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xb4a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x801}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_LINK={0xe4, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6bb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6d2}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffe}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5c2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}]}, @TIPC_NLA_LINK={0x64, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa848}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffb}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}]}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xaf}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6ec}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffd}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}]}, @TIPC_NLA_SOCK={0xc8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffffa}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3f}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffe00}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xe35}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7ff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x101}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x729}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1ff}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xffffffff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xf2}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x354}, 0x1, 0x0, 0x0, 0x24000040}, 0x80) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x0, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xfff}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x7}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1d0}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008000) socketpair(0x4, 0x4, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x28, r5, 0xb69, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_REGISTER_BEACONS(r3, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, r5, 0x2, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x200448d1}, 0x1) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780)='batadv\x00', r2) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r6, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x80000000}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000000}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r8, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r9, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r7, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x34, r9, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x9}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44080}, 0x40081) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffa, 0x202a03) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xffffffffffffff00, 0x8042) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x10001, 0x81) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) 14:26:50 executing program 3: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x11f840) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:50 executing program 4: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) prctl$PR_MCE_KILL_GET(0x22) prctl$PR_MCE_KILL_GET(0x22) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x2}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x20100000000, 0x3}) 14:26:50 executing program 3: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2, 0x0, 0xffffffffffffffff}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f00000000c0)={0x2, 0x0, 0x0, 0xffffffffffffffff}) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f00000000c0)={0x4, 0x5, 0x1}) openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x20000, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x6) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f00000001c0)=0x5) 14:26:50 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)={0x40, r1, 0x200, 0x9, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffff8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x81}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r2, 0x0, 0x0) r3 = getpid() r4 = getpid() syz_open_procfs$userns(r4, 0x0) syz_open_procfs$userns(r4, 0x0) sendmsg$AUDIT_SET(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x3e9, 0x100, 0x70bd26, 0x25dfdbfc, {0xc, 0x1, 0x1, r3, 0x6, 0x1, 0x3f, 0x8001, 0x0, 0x8000}, ["", "", "", ""]}, 0x38}, 0x1, 0x0, 0x0, 0x20000004}, 0x2004804) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r6, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(r6, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="000000003a61cedc0f6fc45c48f843b1e72b177502dddfd2725e6be2ad0dd6047cd51c5771494c1bea0cb18f532c9e53ec38694b01850447da8e3883f7e449c95a504f0de261088e95c4a77ecc4acf985f46d91f1974160656b1", @ANYRES16=r8, @ANYBLOB="010029bd70008300000018000000400004803c0007800800040009000000080003000008000008000200010000000800020001000000080001001500000008000200020000000800020004000000b4000680040002005e000300c7227ca6dbc4df319f6ddd46d269ecd67bebc2fcf17703c76b78e4cba474a571a308b9cd7294c2d093907d9dbe3ab099444344715c7d5b5a8fb6915ea619204b15e04dd4308389ffb1ee956f2a7e26371202d4e995e0eced8fcf00000a0003003a5f3b98192d00003e00040067636d28616573290000000000000000000000000000000000000000000000001600000091d7762fb6d6a0bb43a71259913dc215d936c5da07c90000"], 0x108}, 0x1, 0x0, 0x0, 0x20000800}, 0x4004045) syz_genetlink_get_family_id$wireguard(&(0x7f0000000140)='wireguard\x00', r5) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="02e325d3", @ANYRES16=0x0, @ANYBLOB="200026bd7000fcdbdf250d0000000c00038008000100ff7f0000"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x0) semctl$SEM_INFO(0x0, 0x0, 0x13, &(0x7f00000000c0)=""/115) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x8c641, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x80, 0x20, 0x1}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x7, 0x60000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRESHEX=r4, @ANYBLOB="00042bfb6ebd7000ffdbdf65820000009c00", @ANYRES32=0x0, @ANYRESDEC=r5], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r7 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000280)={r6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f00000000c0)={r8}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r8}) 14:26:50 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self\x00', 0x400000, 0x0) waitid$P_PIDFD(0x3, r2, 0x0, 0x0, &(0x7f00000001c0)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:50 executing program 3: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x1, 0xf, 0x1}) 14:26:50 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000040)=0x100000000) 14:26:50 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r1, 0x0, 0x0) sendmsg$AUDIT_TRIM(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3f6, 0x200, 0x70bd23, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x24000050}, 0x4080) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:50 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xfffffffffffffffc, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000040)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) inotify_init() ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:50 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) 14:26:50 executing program 2: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r0, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48041}, 0x480c0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_type(r2, &(0x7f0000000140)='cgroup.type\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000080)={r6}) 14:26:50 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:51 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x2b2440, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="00044b3d974c0000", @ANYRES16=0x0, @ANYBLOB="02082dbd7000fddbdf250b00000008002b00ffffffff08003c0001800000060028000400000005002900010000000500290001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x40001) msgctl$MSG_INFO(0x0, 0xc, &(0x7f00000001c0)=""/151) 14:26:51 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f00000000c0)={0x444, r2, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER={0xe4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd8}]}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2f0}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9ec8}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x40, @loopback, 0x9}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10000}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e20, @empty}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK={0x114, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7a0177fc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x72}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x28}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7a8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NODE={0x1b8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "70f3baa0bf6ed7b823ed01884024cce2520d216c2bf22648"}}, @TIPC_NLA_NODE_ID={0x9f, 0x3, "a3778b9ae56d7e82efaba2a897664cea8aca993fb5c46ba782dd38e5dff7097520cc9cb7078b141cb02400ea203bf3623aee56c20b7b0523849c4214e3f9857dc71c56c8a7a2a5dc7d492efff1dee0e4eb66a1544dec361027d745f6e45cbe059876fb0a49eff507a055196f8063fd5221303bfadac9bac96c287353aa178cec017d188afa1fd0328cc862f64ad39a0528bcb7d4f1c028bdea2ae0"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "265385e9fabf0f15aee3c7cb10127658cf2c304f102ebd05c4d4518b47"}}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "a8df74c0b18d739f9632ba9f9c7046a512d137edf35843"}}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "1748102a5bac6f8d5b1327b996dbe0973fdfdf935de70197"}}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x30, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ID={0x1f, 0x3, "a527655c842f7bcd72952920650f8ac17edab285673cf8e3930afc"}]}]}, 0x444}, 0x1, 0x0, 0x0, 0x4000}, 0x80) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:51 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000}) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_RESET(r1, 0x5514) 14:26:51 executing program 4: openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x153483, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00', r0) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1ff, 0x1, 0xffffffff}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000140)) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000080)={r6}) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, 0x0) 14:26:51 executing program 5: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000000)=0x7) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00', 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100)='wireguard\x00', 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x104}, 0x40085) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x0, 0x40) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x1, 0x40081) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x6, 0xfffffffe, 0x3f, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000080)={r2}) openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs\x00', 0x1, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000100), &(0x7f00000001c0)=0x4) 14:26:51 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x5) 14:26:51 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x66, 0x68a00) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x102, 0x9, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) r7 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r7, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r7, 0xc01064b3, &(0x7f0000000100)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000240)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000001c0)='threaded\x00', 0x9) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x7, 0x5, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000140)={r5}) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0xf, 0x1}) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x300, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x100}, 0x20004000) 14:26:51 executing program 4: ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0xbe0}) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x1000000008, 0x13}) ioctl$SIOCPNADDRESOURCE(0xffffffffffffffff, 0x89e0, &(0x7f0000000080)=0x1000) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f00000001c0), &(0x7f0000000200)=0x4) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3e8, 0x20, 0x70bd2d, 0x25dfdbff, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000000) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0xf, 0x1}) 14:26:51 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, &(0x7f0000000240)={0x6, "12fa80c7de3142a85a4379db8d51b92645f728c355eb43c7e178ce101d5f33c4753f091a7b9e7b40902f67e5532a95542a36e20ee04147246f6db315408c63d1cd607678e18fcc8c3d789fd2c06ae1f18a9da13fd338e2f56d3422b7e450c5381244b53be151f865f94669966860d0abde749f97292f8f726f83e7b8d307a97018dd6053a896e46a2d9e5f21c08aea0e2ba7cb7b64eb6bb5fb8b268283db4be91b601bd40dfc6ee4faa569af3fd6eaf7a6256efbbe2c7dcfa6ec10c5850781ecd8e6a85d5d08a00686d93c8e042ca198d031ffb78f3062ff2773e7ce50bc0eee5feb9611f4ae6d80fee50aabde8236e739293df9b519c33bf911bbc436769076"}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x100004, 0x62b0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x6, 0x0, 0xc, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:51 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x2}) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x8, 0x11}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r2, 0x80045503, 0x0) ioctl$USBDEVFS_CLAIMINTERFACE(r2, 0x8004550f, &(0x7f0000000100)=0x3) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) write$nbd(0xffffffffffffffff, &(0x7f0000000000)={0x67446698, 0x0, 0x3, 0x4, 0x1, "5d0db34bfc785bf89d2731851955a679ad5a54fa8878130d812e1c3ac782d17a3aff9981f4a43ad91f82883e49f55cd94ab9b87e2eb26631f8215cdb885a05656a80fc0fdcdd6791de634df569f48e5287329d1dcd33d1543d6f43d71446a07ec362e094cb8a924ae55cc073ba759832f3aec9356fd6b74ae27081d8e9a423a35b9b7cbca0dd1386aec864652b75f96e6a86975be01e1a58168d49ef7dcabf02036c81694de1fe168d374cbbacdf7948c342ff53facaafc3ed0d85c19e1c315777c6e4cb40d1b4c4f55ac83560899b3bd224"}, 0xe2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x0, 0xf, 0x1}) 14:26:51 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x54, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x20000}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004001}, 0x2000c004) bind$alg(r0, &(0x7f0000002280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0xffff) r3 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self\x00', 0x210700, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f00000000c0), 0x1, &(0x7f0000000140)) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000080)={0xffffffff, 0x5}) openat$ion(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ion\x00', 0x10c01, 0x0) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0x0, 0x1}) 14:26:51 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x2, 0x5, 0x2, 0x7, 0x803, 0xffffffffffffffff, 0x6, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x3}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0xf, 0x40, 0x9, 0x7, 0x110, r0, 0x4, [], 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x40) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x80, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000140)={0x250, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x94, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x477}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xae0}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x80000000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x670e52c0}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x40}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4ac5}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xf5cf}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x24}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}]}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1dab}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffff58}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100}]}, @TIPC_NLA_NODE={0x114, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x74, 0x3, "6edd20394ee175269cb7d25df98ff847b3c1b1de4e8e96e9338c69b2afe6c1e542598e222e95b6084a1978394c5a6a4735d8f574eec569e9d918a72f6ab057dbf587c3eae0d6d643beec70c786ecc3a01832aaca9d7cbae35abf9537751acc6ff62c61e5f525f2adc893954b32dcb2ca"}, @TIPC_NLA_NODE_ID={0x86, 0x3, "7c600dbb91280c45e4abeae9ed461d23d93ed22291b32f22bad306da1ba11482d8db46fc75171fe14820c82e27f7c5009cee38d1c9a2e899977475fb8bd46e560248405ba5d25cc276c2c606647a172301a912666294a094223457e3cfb7d97c972d607654ce364099d2d9866c9982ad3e8c6cea0b6b2f686313b4bbd64d6f9d3d9e"}, @TIPC_NLA_NODE_ID={0xe, 0x3, "bbb4224c35a8a0319c70"}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x20040000}, 0x41000) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x2, 0x0) syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xacb, 0x14200) syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x40000) r0 = syz_open_dev$usbfs(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x5, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:51 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000140), &(0x7f00000001c0)=0x4) inotify_init1(0x80400) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x2, 0x2000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000280)={r3}) ioctl$USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, &(0x7f0000000040)=0x4) r6 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x8, 0x400000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000080)={0x9003, 0x6c, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r7}) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) socketpair(0x2c, 0x5, 0x3, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x94, 0x0, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}]}, @TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xa6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x56}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:51 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) syz_open_dev$usbfs(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x2881d7e3, 0x424280) r2 = syz_open_dev$usbfs(&(0x7f0000000200)='/dev/bus/usb/00#/00#\x00', 0x1, 0x2000) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f00000001c0)=@usbdevfs_connect={0x9a7}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, &(0x7f0000000240)={0x8, "5de3b39bbd257187468f9178bfc2a4d45dc96842811550440341af8427ee1b5d597d91e0463114107336d51bee65f2d3a132e9a2719b6ce4dca985873bb4966da774c42a37f39fd387b44abada576ad7d23c983fe37f5b62755c9e875ab59c3a84ea8864e5038c1f996193731df017ad5f90c727bfe07e0ddaf77d86ce496c7f7417bbc995e9101726d4cc8466ff4bc83b41960ba5ff4a0e1be4606a9a4de4d4537211da11a6ba3396c6c29ac7cfb29c90c259c4f4247311f0b4c44a2be49cadf0d8b3a73ab35996e3d8a1a3d2db7290f2e66916eed8644b864ce9e297c2acb3f1ea6f4f497877225038dcd0ee24d284e3e354f273c804152dbab74b40042dd1"}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x3, 0x4}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20004804}, 0x200410c0) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0x0, 0x1}) 14:26:51 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) socketpair(0x27, 0xa, 0x4, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)={0x230, r2, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}, @TIPC_NLA_MEDIA={0x6c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x7, @rand_addr=' \x01\x00'}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7ff}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2e}}}}}]}, @TIPC_NLA_SOCK={0x98, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1c0000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x80}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x78}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xbe3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7f}]}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x100}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x40}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x20}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3ab}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xb70}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}]}, 0x230}, 0x1, 0x0, 0x0, 0x4c095}, 0x441) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) socketpair(0x1f, 0x5, 0x9, &(0x7f0000000000)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0x0, 0x1}) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) r2 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x8000, 0x2040) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) 14:26:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x7, 0x73}}}}, [@NL80211_ATTR_VHT_CAPABILITY_MASK={0x10, 0xb0, {0xc, {0x681, 0xfff, 0x9, 0x5}}}, @NL80211_ATTR_VHT_CAPABILITY_MASK={0x10, 0xb0, {0x10, {0x3, 0x7f, 0x9, 0x61}}}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_KEYS={0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x1f}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000140}, 0x8000) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000100)='1000000\x00', 0x8) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f0000000040)={r5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r6 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000000c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r7}) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf}) 14:26:51 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00', r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_REGISTER_BEACONS(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000020}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x6e}, @val={0x8}, @val={0xc, 0x99, {0x0, 0x4a}}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x4000) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000100)) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000200)) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = inotify_init1(0x80000) r4 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x10000000) inotify_rm_watch(r3, r4) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)) r5 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x7, 0x101000) r6 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x185082) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r6, 0xc01064b3, &(0x7f00000000c0)={r7}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000040)) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000000)=0x2039) 14:26:51 executing program 4: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x6, 0x4, 0x1}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3ff, 0x37}}}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x40090}, 0x810) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000040)=0x5) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x8, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf}) 14:26:51 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x5a7201, 0x0) 14:26:51 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x1, 0xf}) 14:26:51 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x8001) 14:26:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00', 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, r1, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x8044}, 0x8ca6c5d76c96adef) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:51 executing program 5: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00', 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x40810) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="04002dbd7000fbdbdf25dbd21b310500380003000000080031000300000005002f00010000000500300004000000"], 0x34}, 0x1, 0x0, 0x0, 0x4044000}, 0x40004) openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) 14:26:51 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x27, 0x9, 0x0, 0x0}) r5 = inotify_init() inotify_add_watch(r5, &(0x7f0000000140)='./file0\x00', 0x91000400) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x0, 0x7, 0x1ff}) 14:26:52 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getrusage(0x1, &(0x7f0000000000)) 14:26:52 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x3ff, 0x22}) 14:26:52 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) write$nbd(0xffffffffffffffff, &(0x7f0000000000)={0x67446698, 0x0, 0x3, 0x4, 0x1, "5d0db34bfc785bf89d2731851955a679ad5a54fa8878130d812e1c3ac782d17a3aff9981f4a43ad91f82883e49f55cd94ab9b87e2eb26631f8215cdb885a05656a80fc0fdcdd6791de634df569f48e5287329d1dcd33d1543d6f43d71446a07ec362e094cb8a924ae55cc073ba759832f3aec9356fd6b74ae27081d8e9a423a35b9b7cbca0dd1386aec864652b75f96e6a86975be01e1a58168d49ef7dcabf02036c81694de1fe168d374cbbacdf7948c342ff53facaafc3ed0d85c19e1c315777c6e4cb40d1b4c4f55ac83560899b3bd224"}, 0xe2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) 14:26:52 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x6, 0x400) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f0000000100)={r3}) r6 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000140)={0x9000, 0x3, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r7}) r8 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r8, 0xc00464b4, &(0x7f0000000200)) r9 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xfffffffffffff000, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f0000000900)=ANY=[@ANYBLOB="010000007106ad99ce00a019b4c466bc2fb807ffc6e5d37e350aa5368646a92a116d01b7088dbf3b24b9200da8452189207295a9463c980c6deeb0e1a902e9dbb6e0134fcdee11ecb1ccbfb55a920e1537471c5ec444844e63575516ca46c6ff8c79dc7d703d56b439228dfec0503abd8a05b1c32828aebc36ffd7577a177cb37b", @ANYRES16=0x0, @ANYBLOB="000228bd7000ffdbdf250f0000003401018044000a80080003008d02000008000200076200000800020005000000080004001f000000080001000300000008000400008000000800030005000000080001000a00000008000300f00a00000d0001007564703a73797a31000000000c0002800800020000000000380004001400010002004e22ac1e00010000000000000000200002000a004e21fffffe00fe8000000000000000000000000000bb010400004c00028008000100170000000800020001000000080002000000000008000400050000000800030005000000080001000200000008000300090000000800020044d7767408000100150000000b00010069623a6e72300000380004001400010002004e23ac14140e0000000000000000200002000a004e21000000b0ff0200000000000100000081073edb2775eec3f9d700000000011f960526040004803c00078008000100060000000c00040008000000000000000c0003004b090000000000000c00030009000000000000000c00040002000000000000000c00098008000200040000001c0004800900010073797a300000000009004b21bafe4a9eb3e70e7059997a8b7d"], 0x1b0}, 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r9, 0xc01064b3, &(0x7f00000000c0)={r10}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r8, 0xc00464b4, &(0x7f00000001c0)={r10}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r7}) 14:26:52 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x9, 0x8000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000140)={0x3, 0x8, 0x3faf, 0x0, 0x0}) syz_open_dev$dri(&(0x7f0000000200)='/dev/dri/card#\x00', 0x20, 0x4000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000001c0)={r1}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:52 executing program 0: semget(0x0, 0x2, 0x9) r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:52 executing program 3: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000000)=0x7) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00', 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100)='wireguard\x00', 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x104}, 0x40085) 14:26:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f0000000040)=0x4) r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_disconnect={0x7fff}) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r0, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00', 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000018c0)='nl80211\x00', r2) sendmsg$NL80211_CMD_SET_MPATH(r2, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x44, r3, 0x100, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000015c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000001680)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200026bd7000fbdbdf258200010a08000300", @ANYRES32=r4, @ANYBLOB="0c009900050000000e000000"], 0x28}, 0x1, 0x0, 0x0, 0x4048850}, 0x40001) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="ff002009", @ANYRES16=r1, @ANYBLOB="010001010000fcdbdf251200000005002a0001000000060028000200000008002b0000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x44090}, 0x40040) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r6, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, 0x0, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000001540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001500)={&(0x7f0000000340)={0x11a4, r7, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x81}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x20}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_NODE={0x100c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x1004, 0x3, "4566d9540edfab00da50e6d7e2852f3ab1037452ddaafc7f1c3d88200b995926cf299e89fb0106c253edb5bac227a1657c3fc59798d275c8c37404712ac339bd7c0a08df5f737cb6b2c0750b17106fd1a2cb9206377d83290ee0c4315856008a5a19bd786e2c29f7893d087ffa1179f6f26ac73fddeae0a256861439c7b77074c935903e96479cb66c57efb03184ead827dd31c53533cb940a405be034cf1ce3c3e33727579c6e90b31fd2a6059bdf0fa209bcf7afada49dc0fe863e1d40c7b33c796511888a872869825a1512b04e090ae8bff26041ee8cb8319504ea5f6bbc337de065a957f7bf6eb3fd563e3ce0d105bc06b108997dd7985e0effcebea4c6270cf2a34566451a82e85caa6ec4c87fe4a09bfbccf3ecfcde76d785476ff862cfa02ff4030f969f8d2fe8e404210ce256705a7129c59a9a686dab9af47287821283db56f6d7371d924570e6c6334dcfce1831f085f61755c607e0d81e424ba6b709aa7d58024db25d9edbb230c5a386285ededbc5cef0cc674263caf4822768ec379b677dec83ed0502b4c3d629dea1f2156592b7791c0fc112097128e84ef9a5f0fb77ee8c6d191226eafa0632a446133e2118ab845cf71ecbed155ba09bb3595ba3f437360b82573f1e84df589121a66f257b518c803be6de8c9ad749a3b3e1a4879cafbb9a6fe6bdca74030722753e5f5786f13ec7da0b1cbd9783fcb6b971c46a0145a5f07126533d1b59cf859e1236641e19e4058ad2a3151824bb4a788c98d0ce7b003b324f5f0b096c3b23638fe16936f204150680efc14d34aa52737db81cde2632a0fbb8dcfb9d12a4f271ac289e279b28a38a3f73b593e5a8469335a86d3fd030f6f2a6addfc25e4d7cfcaa2b5b872754826af0e6bfe64b89ec72b0c7e8d9ddcb9044b91dfd26f195e8a3a8b1ce333af2b447620a73de860fe65babfbf4c505342fcfcf361d218298baf0c537f733f571b67cfad657425106bdfe5fd1b79045d57ce534264ae826d5968d1d219b81de18d861086b78e63b50cd5a5736aebbc2ed42ec92d68ebe1ec121ca911269bdcf7b50a5af429dff4420eae6587687ae235fce7afadec3c232620c58c32dbb1aaee942b170ac925b5c2183c2177748eca8a10d6f0c2cb828c973c554614c8b300f698cf364e564f568d7f856e17046138ee9c384b97d46008a157b583084692578a40a385ac6dbc95bb76a197d9ecbe38ee14226729c1d2457ad282a33d0a33a33bc2cd5687e32263157b04c9cd9205f96bdf31099d9cbc307586b42e20a38119f7865f8b165b7f1987917fa268308c50a7210478dd2f13911d4deb474ddec79bc1d8af6d6af0e3c63cd3f71fa6fb44f364324141ad5888708f48de65c3eac7c5e35a2e32898f03f6a4d3e82c4b988196e6206de63bd2f4f0f1af1bf70bcc96634dffc03fe9c48b7a76dbbc7bb8c8a57493d9562cb9a3ca332e967fd257a8f32337f57ec45e8f31f62cd1666b46622f350b96b99f08f3172b3ed4329323cf3997929dcf34d99c790726c27a6f9e9e93beca9d873b02e5a68fc8b4c36b538f7385255c4cfa07715cafd40cfed1c9a85aeca6915308c97e23598e1557d50e1bde5c7936b15c988b442e0a125b5c3049e1e3a6eef7c3573879e6254ba402d06101263acc474ff5b26006d5acbe9fbffe95f433f731ed5ac02c9968aeac322c4aaa4edaefc50bb4365d6e25868145de11dbcaab20f31a3b6726c89dfcae99d56f7dba3b8ad14fad9bcd411f4663dae44188a48ef795b0125bee1d453f1e63493ecc30c23aa69e9d69cb65ff6759dbb6482cf9a64aecc391cbdca50615e80feb2c07fc900b98f3922dd8daaf0e8c7cedc0bd408af658b1390d11af4f85a348750e8000c291b740569756dc280489a60e1f7b587bb156fcadc58e6529336b8b963a6b9b63c4f88b54e2e9f89e771a5ad3ce71a9720d0bfad6339472c0999921bd8b434980c1a85dd1ef23e571ba46cf598ce6586d403784281b17db6a5f687014e34ae87c76253619969ef765aab9cb0731a9ffc27307ef2465cb015e9b2fb6d652461034e77cde4b0765e8100a46762eea8388530d46fecd967bc830a829ce5001c5179d78778afd5dda4c43a2b66c3bdb58e9997c846edc69dc42c7c374847e756b702aee82bc1b817565aeb4d18693c58f7361c6a373bda10ad8b3daaea7aa7de3fed255b857c4859209790d358f0b302f6c2ee14d465c2aae58237d644057b596909aa938d2403cf3c67327b1fed1069566312077e3134b88587b340b85729472c9484bf140b1294ff530d5af14544bbeff64c9f1a22f2f16088f0e496203c6f1a9aef0c15a7a1829c1443704ef93dcb04ed03a60b150f90a62b9a44d6a9e832478e63c85011091123eadd4cf070eb892158603a1282bb02657bc39161d5a7ab6cf5c0f7d1f5071059f0e5d7ce95f214efcb187f0365c6e60e3fd67df5481fd46fccf1459df8a11b475ea9bf45a0831f56bf6853bcec377440f97f7a586dd3cf183b5e0bc8a214c60a1ef866324831469af676ccbdd7c382ade145af70dc14e046a5336d257ba1b0f206f35207cb986488f1fc56fe3beeb5e300617a70aee78fa5af70020fad2197bbdae87485891d06a259830694b3e2e5a38f5918afb2d9d475790d7cf155cdeb187bfd50fb1cdaf9e2914350f931c8dce561b18e59a406c384efb0dbd93d00809b5070b7b3732b1177caff7a1fa578bb77956f77f79ee23ed82e0877ac748b7c53277335a5b7a09eba03a4d2932d69ef63b72096065316a5405ea7e9f061b05a8b4cec683f9ebcc2438cc57fa5352f4e3d638977f2a64a26acfce69e5d2258053e2ae443728e17855b44cf69881fa91fd2ed5530c194d532a61e22bcb5565527ea9ba41b2bcc8773cb406bdcfd0ffec4dcf4d0f3d3976d9249e86d44b16e4e2203ae85ac125e854d66777aa35afee35d34fd888f3708e7e9dd60797506d41893791d2bc83d2e6375293d78b7f0d54ae6c4381131bc6cdfd4095041aec74dcb39408fdc7182ec0bd10a92e445b7cb667b765526e7cba3fb19e607ecc8cd428be87475340a7e0ca6fd86720484419be8e502d327b5bd2fcd951a225e8d9f2374b423a9108e65070838a2eb3587a8e12d100406672c8dcfffcd333fc3b9dda5c26942711112dc4a0e069b8cfdc20ce35211e37c3183897b0dd75c3299da2746b7cc6380d3d77130724f14afa2f1b36cb3ff30d86fbaed5ac05e14be0d207b9130cd09b03945a0ad1ef68a0759353e7159baa2ad2c06f0d377f4688c373dd2041f58b4c1cb9f89c5ab5c5e626771aa78545c62da2c7af53233f41958bc179cfc1a2abcddbdce30bb273ea945b336613d48598cf998843611fe7cb087484159059c5504bc9e4379edb379cb7f1cfe868bcf791a853f4c4e96cd52763e000ac1587b588169a82eb36307840be35eea03bcf76ee8d6f0a5b8659c4cacf67513326232a3bfea47ac3edb356fee9e28f240810918447cc2c0413fdb7db2b06726dd75cc458c0257634867c8e15e7690bceba582a7caf4ff6bb6e20d93f54c68d7000c63ee625334e5f7b58c85a25badb97f9f012f61d2f8ca76536e4a7d1d264e663ee90626a40e14728ef97b61b990a04de48194842a473f99b7525e5431f04a96efcce4078e166ba4ad95bb812d0bdc7202535cbb3e39bd46d4ec57584401c494037d9287461e9e080cb78e39e9c14436461bed18110e7e6205edce5dcb02698db66433f43114c450be84cabd1c64455058c97849d5b071dbe680fc6238c4cd6cd4add3289f3251abd3e333c9f1e25a09a4b6b0560af9df369b4ce5e4855865be1c4f718c149e2dd41cdbc58924ad66e87d49f6dbd01b04191eb03ebf2f4def400cba49a720ed44ac4c10e61096f51ef243f1429bb3ea22074480afe94b3e5dff768ef71dfffe7d785ddf9406f9d1a972e8f166c28a08f114c44aa7a700e84cddf45424d872615ed27e8c1036b3a4cf30944fed0d8dd09be3725b2cba24736e46104ec405963c238aa7bdeeeb52f3fc2de901af6139129fe7b285f2ed1a0733232aceb6dd8f15abeeb9230007fb35b4314702ad6bf7010bf9c96acb4d46093cd66713249d5257af2c81fc77d5b60041dbe67107e120370597c8b2ec56f459374a6fb07e3a157439378742de5fcaaa6f45c1310fae541a2783dec8fd8b86097e5623cf728e13d8299b5ed9f62b97bbbaa20776db6a2598d53ed2998c4dd166076b84d24eb27a1495f1cc987bbedc2ed37a0f85d4cfe76d3bdb7a9e872410a1b7776e9c72ac44e19d850fc88c9348364219f6e577cd0da5b7e314a98c8a7c0d030ca48bb1500a3647cc4a343946cff229cee60c98a19b32a39dadfb3ec09dda8144fcdadcf064f11903ac53baa24be15e14c8b718b80501f306973bb33a5429f30890d76403951e0a547437274e9bd487d225592f89d65a8bfe5c04a01d2d4a9bf31a4e28527a0b7399f245cc85dde6572157fc984fe491f0677edf51a9c6009631a7cb7996f78cdbb32d83331a62d1cc399dcc6cbc73d3ba0e24df9b22608f3e72c353b955cdf323343b6d01e64dcb40c47210e7849c923b2f882c37c12d014970073b6a0c7fe9e993c39c56a8b117b65f35fd1c2363ebf07b72c9fab383aa9aa828e3ad740138180fbfad6878076baa5b2d1ef27ca5231838d2f4ac11ecadf55f6868718c6c3a79d4bfda32b138e3f580559b67826c0e4f667c89f36993bf33358830b4b98fdfdff0ad940cd5b6bbccc5363e758fda86f85d845c3c05e0a8e0d5a3c0d518b7837a50e62c42ad0bfd9cdbfaf79aee0c8732ce9f1bdf2737e8b17c274a32a1eb342c0a8b6d3a54c2fc7a3043085bb52316efe6f51e00f0f84c2d676f1b022e8b081c98246ccba49cc22e7f32572cb2a897748d3820714e2295f5f60753aafbd21fc1733124e6965815c0867470bfb057d8eced9f07ba48f08aa1a7d897ae3adc4cbebc2b0002eec16edc30e20f1c8b448581b245b0f34b02e861260fb33731979c2377be5028c45ef2f05bd93791028f29bcf7d7bc39ee8185c1ce2ba0ac0554cfbf7712c81f44cda650fcd544d3962541794c6d4b2704173f4f7a53a34de19601001bfff847d097663a42bb5dff9b26cbbb598e34b91c766d323a61a8eaba71770c072510ef843b23c2d6bb1a8de2bd6e678efa72b6beba0f0a4067ab47a42454547c03d962af1a60b69888bfebcdd48ed1da05c92ed72e4441760a1ff8bfa73c199c39afc14bd15660f61f88d407307f0eb4d3d7a71fcd90cbbf57965ac2d0b2ece8c55f6e0d22a9681a5036dd80555e1e1e77d24214e0f309dad59cc33abbca72df326b8c982e47abf9a470e692ccccb33c9c7ca9c8ee579f83fb5ba513181f38af3579ca551cce21fef37b70ab0552ab47565a7389549c64b3af938d5ef5b25df865d8a387b9c14a34de1325499790ff47a34a8a4c45161758373f5152800ed43de8c4f4d91cce9e84786fc7b1cd877d73e5f9abcb7a320f622669d100d43fda7a07f7adc08820c96058532590de8ab0dffbd121db3230822b3f2ca6f91d364226692d24efa2b09060dbcf2db4b374bad105f743f56e4d963ec83d797aadb47e7f6f129fe493fa0977b580afd2469f9a9df876b5a1f4b22c03b6f4a08b8aaacff4e01584b31d6a6cc5b6f184664a03818c04a586a5f5d4258f6482d8c8b48268a98bb22605105a244ce33052e650abb167fe325c84e45caf1b14a69e729ae864d7a86720468b1dd7d2db280e4eab8cad70cfa7c7eceb12c529529d7742cbc6c6dc"}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7768}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MEDIA={0x8c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe61b4f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0x78, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}]}]}]}, 0x11a4}, 0x1, 0x0, 0x0, 0x40000}, 0x800) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r8, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700)='nl80211\x00', r6) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r8, &(0x7f0000001840)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001800)={&(0x7f0000001740)={0x24, r9, 0x20, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x9}]}, 0x24}}, 0x4000000) 14:26:52 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x4, 0x101, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) 14:26:52 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:52 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x200, 0x0) timer_create(0x0, 0x0, &(0x7f0000000100)) timer_delete(0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x100000000, 0x400200) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000002280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="1486ca37b406f22001800ad3e38794d19a7d8879c59cb9711edd85343d5036ad1132c0c5f52785f85a7ded536c8913248a8b70375fee241246eb46db14b124bc1edc5601646e3e6a1b52974284daba58467e538ba7074ca7b4c815242f5576e42b9aa791712b8912796ba792a436150d072e4c6f213e431de766755bccf1ab6702bd30807d05dde4871aece2106f1b1d1bd2f2f668d4eb290d5f72adb6b3b353e9111432f456dbf4a18271a83b3dec23", 0xb0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x8a, 0x11, 0x100, 0x83e8, 0x1000, 0x5, &(0x7f00000001c0)="ad669a455114fd683a96c7046b6754a57d516777dcd5ad2b7e094f6fe33c3fbdf91e2bc6605d6a99c3ddf7006a465bf619aa584642fc98bb3c66d103f726a756e1d4285670d57893f5c441b596e3ef2db8bf78acae548a68b41093e6740fac92504bd2f3c667a505250b58f53e2acc1097587f788cd9ab17db870b0e255bd37e1af332b8fc2786fa10f02587b0a9133ca0487e52195820b4de95bc2575d1a7516348ce47274a1646918b20fc26ad8c61b92913a31939834d1ef99619e35f29b0f61ab4d2a4f3915af5018285bd0560ed0cdf4f5da0f82b953dfa2dddf8ee858c73e3de7120f07c91834f9b43d6f4de6db3ab3b683bde7bfda767c0507ef9ee961e71d032ea75d66361fc093f7aa73dd312599c8e42c0612b02b26f847aff7b2def10e0ef103ff714a00342a85b6680076be95bc5f1c75b0eb626a19de8488a92b16dec0482eae889a4cd59f66ca9fc9e9dd9ae542f4e77e03691cc4b9b1fd59be25d92e5e436b5bfcbe759d851cfedf33996dc98acbe74996c6817eb393cb4532bdc3f13cb651b46b543d266ede64ffb1951fc728cb4350ab6034b6afd5eddcb3ce234d5ef235ed3d8d8a22e09819bf1ac7c0e98df5e942c76acb5e5f9b0b9f731fbdea0051a5ce2e41c78d1ddb17f0120a8d2814f860a79cdbb3cdd37be4b343fca9934189d7e00c5d42efd42f05e9f3a79195a65480cf682353bae8fa0a7a373d8c4ba7e4e89aba6284dfd1288fcb3ae9b1ac4691de8721369e93558fb497f9bf3c425e867bfbc87971078a999151483b3ef1d98dba14ed19aa1fd3ed7c1554a7a8297fc5eb3d9737416349ea55a1a4127498db9585f73451f1ccbfa6708aa04381eff682cb7b276fe9538b2efc552ec49d56fbb916134c91b563c14908ce612655d3cf617573777636981329533cefd83238210642057ad8747ca8c953c31cf42a76d4805482bcff8b9e24dec8b968bb58fe32a798c12e46bbe163eb514ec3c7e70d4008564ba38cea2f40fc6c15150b0736a79b0323769ef2b9e2db1309af45261cea9d5801a69f243ed864afbeb7cbe1db28c39525d9681f9a3cee942c2e809c141a47b8f9d81a331615c1c0260cc867cddf3019ba8a43c42305c3c38f2ce636ebeb8fb77dd7495eea63bb9e8555fea51641e13fdfdb7b57508672f2589f76224100e156d249e6dde77f11c45740085e3bd76785c5a4133c5952d8c3b798b125a34038fbcc16f4f5f9673383a1a03a1c661c0c958b965e68210372e1db462cd38e6aeb2a602380bc3b2a39598f7d06e2b4f0351260d5d180151cabc27e43cea88a56cf8eec524077db3748934da0a7e96d7bcc0e57fbd9b44540222886df31e9a7319df3957fa3e4410e62ba94d8318171d92741ed02250badb31c419ec2e90c43fd095f7e87b3b5619857cac49ecf1c5ed83dee0371eb55c404b641638ceb1930cd6eb0d2a3538b002256adbee3ff6a2a0a039a8064a37882b121614335baa2781f850e480c51d0d1fe2dc3d599aa1e5bd45c2744499b072266586ed2820f81f6a029d14c2d1e5b2b7f9c6cf600211bc89581b0cef5ad91b6d1898c0b94dc540620b002302838e31d71d2a40ea14a6d6c451ec02cf2a5884b791bcb7d60ec8c7afc98086e051755f2ca94d42a06752ead1c14f00789dd908018a64ebe372520627adb72b9981744c9ff625d7680b867842fecc6b33e540d2781b7c333812297dfe0473725c7d52d3f643c77574b7c88d55057b140272507b58a17212bcb3e0550d34eaac95348bd2ec71649316705112d4a3f1eca46fc206e2aec1ad7c8b935e0df2cb0aaf30d797a92dd7faa2ed5d94bd8663fef195f44feeb83957186dafcaa22505f3e1d4ec2b98f1d36764e4ce15a1312b884d6ff0bc3ad1127732acfc6f8e93c6dddd37dc9df97160716ae63dababa354faaa44cb8881a13b88b76ac4536105e8b98d928c3a778a1af98c3fc9a33364a7a9c83fc5be8d13561c0e4e83658fbfc8ca766519febf717a1116c15f2ce5c2c67e3d95c67ec65ccfd73a028b62f9e72e749ee57b51fa1ecfd9eb6855107ca009116ccd4709792b329e637a66ba7bd1ba8edb8344d745b0559637d9d98a3ec85c2cd742ff620b24617bd842efae3b07ab7e4c0e36021eee396ae32ade30595f5af70aad35dc9ca99948cf01f9f67fcc91b610abed767a6ce29cb8fa226b1acdd84ac74b742b99ccb544eec087d1ae9dbfbaf82fda04351a6287db3184cc5d1744d616318fc85c5c0ac096f5a80de53628130389c50941b77d5b642371eaf36d74fdfb92931de95d8798401b7a4a8297b17f30e3f4ceaeeb7d2ac7ad0c64f49baeee03c51bb74c8d9e4e5437664b9c8348286ee54ce5a06a51afb7af3341aa51330d6327d83f64455fa2320fe0ca2f82d7895023477e778c2b2fda4cbf15bb14f31ece7701e96993de8926b1a8b71c7dc30b95fafe1e27a36b1db309512a0b67d38ab83307fc6801682ca5ffa18853be4f3c7e4da12c0c586701e22a2cc1708b08241b2517388c83d91cdc363006dd108af4797ef9d4d3c180015455793bf54b38c59b517e6691f69f1baee178206f8d4034c71a1f6a6f614229fcb74eddd629b1c22d48aa32a5a72d1e3abc86920047c3d90aa2037c3ac1ef2130e7077cb1d622cd83c68fa8b80365f9e7f8827fdcbe77242ed22a3d4ac0582a859eb037d0e595a2152432e387e74395977778af8af98f8fc3f0f0b4a820f50332234c077dc70c95985fa287b6b3e2835cb31fc1d5702f114440c4d1b0c4b7c98870bb8c6d847d81cd1babc820b315e39a9e9f211aa3cd81b15ab27873848c6bc8f054dc1bc4268c4a5ab98c327dc07a6b376ee0ead4314aefd232c76de3137fed052c864a1a3d8cd244cb6889db30a1046e8d26a89fffa609977711565c5cc5853246ada6e722f7c1c08873000660e37cbb10f40cafd91348e028c317e78dd6f5876bb6e9ccba1877c77c2a8fd0dc1a6cec6689e582a7fdd0634bc920df11104818ecdff15b3fce87407fa025d309bf222ade8649438d3379703c0a159b9f1df409639d4db5093e6fa2fec309ff0546ea0d705ed58fa08dd2ef2967fee96f1ec61c43d5c7cecfa5c152b94d10b3e08bf8db31313da5db0f1f5d68e33f330f46a7cd9e132f496e2aa4d85dae2f385df8e502ba3d231f03ad64c2ea5ab49ddddd90a60394bcc892d146cc11ff0611d3e1a22f3bf06063ec9572974059f7842d772a9f7818321ee29571c711960ccc86468ecdcf5b0922a48daf19c343f5b50b0aeec483483b9cbdce1e0a80e1a435e582762ee9622a6af3b7f1bfdfaf176b2413eccee61b5ce03a924750dc91c57f1332d6960fbf753809396519f48983f6d2bf4598add615eda6c323e79bd84cfafcee46791ecaef7c4fb94c81155262a6d55e159b65d3d281082984f7d7ce00b5b64dfe6c2ad22a8de9d1588e0d6e254c2901fd38ea47878751ced67d21cf0f2b07a9db4caf441d8ba8da47c5cef30f00d41173ff58e30860735ed5ae0621e6a42df63e294c7bd2a66d9cfdce15a86e8862e396953a8b23b9c118d297a67142f832755408568d8d4b5855c23780ba1ffc140604ef37b8b86cf984f4141ff60cd908892b4a614e89613027d63699c25bc4950fb6495a3ddf87a372a85be2e3f70b98a5a88de69eec081e6e29d083f46630a1ae72cb0b052751f63e12ab4c122cd7e68f4a5aafd0f08e2a29657a174a74d9fe0138021d5adab2c5db7e31817e64b398d62dd3bf56751593b05a9af8f235a8bf82208c26c5b11173107ad5f41559c2895119258f7282ac955109adbbeeb58e8cabd56a22139fe5a66099d5b99c3e016795ed63c2d0c92f842232224642ae203b50c2c72ca1a05c59301bc665f4c619c0f63b5186a2269693edcf12b91cbc85c22100a2c79930dbe5dd3efb921fa773ce4df007f3101bc4479407fbfea45ab117f89298de1d5c5df119a87b85916d00880ce13621755e947c18e25df75f2a1b20af56ca5d9097f88cd4ff34e4c8fab9bc7a1171877d5ce334083493b69680d5e8284cab22a3667eda643b3acf8a05391144deadbc6b6913e668d652044397594f102ec373e1eed2239cf177102416fa1f8dcf075d277c7e3f75f54175773370be869bb11cfaf332e3b1bbdb7b9c281b2b35b10aef512fa5c965d05a840b817dd676200041ec52bc3fdca2e53e816dc9c16242e42a974ba91f0c798e5e3c9310c0ac2e9a3ad7bd70f2a809cefa923cab0f81cae1911b1def16a6b13019c89a9b77d691a02459242fbf18e5a6e0b9d172d3c08e2b75f22719ad3e6b4c6ab76bd074cc86db4e7b976d931d1129ca0dcf625af24541ddfba9053838df776f94924112fb0c3a192ad5d1f252c7e97ede0358125fd9a3452f37059489a314dc52505d9c53104cfcab361efb069fdb05f88fb24b3d31a239afefbfd49c9cbcf5ef861a3f1633156674d86297db7cf649111d9fe37b5a8f11fd431ef9fad28a396ce8ac0ad6d729453dae20f1e8d1d7246c82cb156614814f080311a10c823ecfe2cdc9c99d00bc0f16a226e3dc101c6db1e3670d20d1cfd0317a7de6a456ba30b35a6ccaf9645f3f044a10849d3dfb0cc3f02be7ee80edf1afec51214c4302c0303bfb2d300df0a6432d9100907ba546728a24ed91fb2112a705b981c8c5a09496485d1ea82bb03e14d7cd7a471424e8a8b9d266613048ab17aa1c8fc540586c792e0ab31dba71e27d58023553ff456b36ae53374d4c93dc3fc069bec26480053b64c67a1301a03c750a1de3d385363384c61faa8d5a035d18707db203029e7f60a9a6abddd60fc0950de0d97c18224e63f00e27214c558ac408547b7a397455732d3d4f3945b720a9f5cff3f82eb6533425a5271b475fa6a120e229267b876ea5416bf462123624b687dd76dd4752c9d51bdf0ea84bbc287929898eba2e1560040b33773be444b1bf039d19d81b67de46ae79f99901c286bb83898579deb3724033aeb283a09ce7e4e2d002dc28be9fe94b6631de3afd41d6e8f7f7d1eb00b1c7ef609a0e913d0d6564459623ae0422026009bf608d55488abdf7d9f4d573617cb97a7f94fc6a2069889dc499933beaa9243d8b7dfe4c8d006d6ea8e684180d06d22529c9ee70ec006e7f82a369453ad6ad3787083e7692648fb85b4e1fefee9f543aec3069a87ef485039bc42dccab4ec20499f01fb30a699b4619b8f488b7e1a4020a345c667f6096fba64263b85259cc409c28dc8ae657af8a58970d0b09a491c1f83768440addc01ce9c901807ffd578ca925054be613755b7a12993c4150ef5bf541bdb13100dbc1640bb078277da3eeaed2cbf542f4defd98ec6254d4c7f3b84fd0c346ff35dc75725751031ff50b4915c604efa5eaf584dc851bf7a06cb21503329a4a13e4fcccd308ee58b1942ffc816bdd626e87e34ae9ecdddeb77c6e2b0223c0cc5a929b429417efe13651a7a169ff81ed1a0dbaa9ea079b546b25a5516d996ea58fba926eff248cca8b972abfb724ea0117f2baef484744fddc8233cce0b2b87d8a6a3109ff6f730898a771bb9c1c7915c0291014c8db1c9945d959762253610231636cd09918fd60be6534dc4f56c738a63fca54be0bc368f3b61f46539dc919fff174925edecd418fcfc33b4f533bc65c7a5b7320eb6780e029a4036a7f35c6e1f4f44ed89335e8a0315f167d429647763a54563b9e7f05ec55baf228f489eb9f37c3d2f6c6a2b689f96d1ad4972f69e72017069beddebfa8616100ab27fd29a52cc86c6124d7e4ccbc4cc1bd4fef"}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:52 executing program 4: ioctl$USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, &(0x7f00000001c0)=0xc00) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x5, 0x101002) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000240)) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000002", @ANYRES16=r2, @ANYBLOB="00022cbd7000ffdbdf250400000005002e0000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004000) 14:26:52 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, 0x0) ioctl$USBDEVFS_RESET(r1, 0x5514) 14:26:52 executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x3, 0xf1, 0x40, 0x0, 0x0}) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000000)=@usbdevfs_driver={0x1ff, 0x0, &(0x7f0000000100)="33db067edafc0997dd89c3aaa0e76558d97feb69dd823bf74063ba7dcda7b717dfe72ddcd011a648ab205e278aaa2ac525e5320d08e25f855d346a55459609d8962b907a58bd6e593e3f02fe8a172f3ac2d4ab0c6e78aacbeae1d27f77b2095d70679e8aba0b69a27e14fab56308338c8c3fb3edb48cea2b9d21ac8d9ac6d8612833f52df6db017d1a93fd6000a6e275e49bde4e038deb16c2fcbf809e7bfda6f85cfe4ee4c366298f6595ecec9430e24e626f30a7a370c18dd031c5ae8cafbe7f2238f9e068b4d33613f4ece284c6a8650a4c35efd5e7f621e3522cc0be24823adf1d933cffcf58bb49e0641bbd3e3887792202dfeedfccf2aa3cfbb966"}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000080)={r1}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) inotify_init1(0x800) 14:26:52 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0xc36b, 0x11ba00) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x8ffc, 0xa, 0xffffffff, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r4}) r5 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) write$6lowpan_control(r5, &(0x7f0000000140)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) 14:26:52 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x0, 0x448000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3f6, 0x10, 0x70bd29, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000014) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f00000000c0)={r5}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000280)={0x0, 0x8000, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000002c0)={r6}) 14:26:52 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0xe62, 0xb}) 14:26:52 executing program 0: socketpair(0x23, 0x3, 0x40, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x64, r1, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x44, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa3a1}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000050) r2 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1f, 0x501100) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x40}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000040)={0x3, 0x2, "088a436fa5a103ad983b10935e624d0175b3bd08fed8eb0bd1127a70bd6538c775c4f22d220fa80f284a7ced591747b6fc23454e2d69c6e149932f279d5ec83994b70c072e8c5abdb23db65b0bae0acff1af9858d2a142083a5e5467abe76d8ed6e7761545b9612266bdad19393aae44dab6d7af9873ea07225b92ab904f76fbdee04ec714b267d0a3417d4f0f28c6cb6698fb2a2f0b20838dcf97a2626f66b28dcf4e22114fe4070445b0a11ac6106ae65bc5283efe419602b3cf09e51baf5da3d81f34f19cd92ecc597318f7e4523d6913ac268fd12cc6211cc44fa98b481eadff310b0d0814ed3a107758c671430b3a93a4f0b603ede375cd51563dc9bbf7"}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) 14:26:52 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:52 executing program 5: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f0000000340)={0x6, "ceebb01c40453c780ce40f67d999376755fc8accfe786dee2fea22824378da44482f357d9ef7c6d3b4969e9e8d84fa418761a13cebda364629fe6aab8491601143bc402943043b87699fe524aba26a6d889d0e25af7b8ddc6034d39f86f65369c8e7a11dd405ad71de34313354feb471d2fd882af3c4e64ec11d34525b2349784fcad5c3949a1b6fa5cc405d25fdc89bacdbeb74fa7f7fc4e5e73ecd1b95ecd19b4303c6542e5863256ba526cd30cdf5bde58a16b03c7cc3bcbc15e8cb14712d1c32ce6d29ae8a3563e073a09af8682fb5aa2db10177333b470768b297913008254299278eb22a07a17a2d7aeaba09c662e332bb508a4a2ca9f369e8752fa921"}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000300)={0x401, 0x30, 0x1}) 14:26:52 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x9}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3b79}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) 14:26:52 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r4, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000100)={0x1ff, 0xc8, 0x4}) 14:26:52 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x82000, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) 14:26:52 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x6, 0xac2c3) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x4, 0x50000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:52 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r1, 0xc01064b3, &(0x7f00000000c0)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b0}) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6, 0x10000}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r4}) 14:26:52 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00', 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f00000007c0)={0x16c, r2, 0xb69, 0x0, 0x0, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'veth1_macvtap\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'erspan0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'macvtap0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0\x00'}, @NL80211_ATTR_4ADDR={0x5}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "dc2024c12838f777af5935e5089e1447f5b2e6f23e55116f"}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "ba5357bf6529531e5b1ce2284f8628834e8777ce12f02f59"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "24a4ce639eb1fd5d9eb616ce53b3fcf7276ac9711f69e69d"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "11cea24689d885f749940fcc3a5dd0f533cf57ef90f61bd6"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "f2dd9c81cac0b09d1b5835d08363be7d43a1b99acf171b24"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_IFNAME={0x14, 0x4, 'xfrm0\x00'}]}, 0x16c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000700)={&(0x7f0000000100)={0x5f0, r2, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x5, 0x26}}}}, [@NL80211_ATTR_FRAME={0x5a8, 0x33, @data_frame={@no_qos=@type11={{0x0, 0x2, 0x7, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x7}, @device_a, @broadcast, @device_b, {0x3, 0x1}, @broadcast}, @random="af424e3cd79e64e52f776b039ff1aa6d305263899134ce05b9a50bee4f808d8f15d5772efdc15ceeb6adde1a74b2d1be2f74d77537ae1c1cc84782ceaddfb878082b964ce352b94f6f84bd692244531365621b254c1cfc2dc24d91eb65bd8403155246e8b26e23d8c453cd94d9763656c2bd8ace5b16043024bff60add118ce9e41ad86cb61830b6aa528d2148a6d9d1ef2677d7d96d252c4b2c66ada5e84734b2252d399f46c724f5a3906d8fab8d6e7bf6e35fda56cdd937a688a8482941237e827056bbb53ae700dc17c3fc0ea6556b07ba5ed368bbc28959b18e55804310ca1dadae2c24fcd38c11ca27920a1c79eb1d52f4d56ad6512e885238b166cdc48b4caec0391b85a6bcf06f9a0e65d7ad918b7e58e870a6099a29e14ee504e09dec5f04ceae13b2bdf1b02ff263dbacfd3a980b9d2b3343e2dc1fe13131b62770b584c696796f314adb1124af1a69b777b9f87c2c0165aeddbfc8c7d33a48ff1cf20d1858dcd3adf85aaf27e0ce17036d1a942db56efdc7950cdcef0ded4fd3d82b6bbb1917f1dccdbc2fd44280f14c480e150c8a4f8104d83e767ec602703bed161e193c361c530229e9a405f9cdf0c90220f89162a9f168b2c6e5457f5c5fbe89c141792f476fda02b1c1ea6cd8e7ac86b1e4b5a209a55111bcca5f13d0e5a6512f4162c79d23ba6d627ee5812446af319620c9c17b3e898a2d3ca249dfa3f0a84e48d90022549eba74938ceeced7a642204afcebdd884ba1624c9fe189e0cae372cbaa3ae9ddabb25da0993ad4064e9dd25bb149e24eb2e0ceb553dc0f0c572b5da3e90ee41186db745e4f62ddb92af67dd7ed1d5f2b50061334650779f966ba073553ca654ade552acb67c5e4b6306e5697aa8caad9679d669d77605ba6184392c22a77cbeb7d42ebf664bfbe0d024c02e0f3c8330da5153ffd812239695573a462f0dc09d0745dfcdfa00a5583a14f31436659334a154fbbd50ac27dd1051c4809ab008681b6bc805abfbcb6b2227c148f9d8f34779499f9bb9efcf8c1cbc75e1e9acdd3bf50a39fde1305eca1d4cdc9071ad0ecca6ee7d30f23cec859f9d55fcfc00f88a0342d1b9acb4dd64d1ee78bae2330cdfb8b45431cdbb62ff15528b37605b226c48827b82648ae88de4bd19ed19f12f5ac660463ecf61a7de5d06c4a8188d546b5dbc4abf5475df889f8747d517954e4363f0f2eac0fb62fa14477a53e1009a306e74175ae42cbdf278bf1385f1dc4706fe4073678b16ba582a28f732445be3f67ca17cd5801520d59e1b04e30ee5dbaadc79c241c281be72fc38713985962f97de8b63aee18ebd9b1224df0d163558ae78f3c25cf19e90a7176ae678a1f3a072ba4c5769ba321c6ebeb9949fe77a8c71b8e92ac8d470f8f8fde8d382ea68e6c0134c36d3b3c8f4841d0e1d4e86d1cd2acfec72165e08341d9b7f3e7063d3723eef4588bd908f1be925b19cef1326a01f153fa12601a27ac95d7df2904de6a9fa7fd3c062e88b39ddc77070d69190e5877d645f2183919932f307b1301983c35b01ac983496d1a612d17668c14430314cf4008004d3f2701e93147bc57519ba883f1b4a2ba9add8dd6e465c1a22aed92eea74a8d1590ccaba90afdbde39907a11b2142a8d0b28672f32075ea256d280cf14899cc2034115e64843e54383fd26f41883bfb747f06d41226405e00b6b88e4983fcea9ff591e53f6b2a82449bc9a0683cba088c95fe9f3ae0cc461116ca136ec90a63eefcffc8de2e7e5c74754393455e7989114d061c92dbe16e2bf6da9c111773c0ef5d76f99eb47543c4c577ec460afaa7c2703607e228e9364d5f7181393eaf2d959c86c2c4afa42279f1b8ecb7aed354d11cd1dace12ec6fc69412e13341f6f8a52a817568a4d525a836edcea81b7523051e25ba68fcf9822dd18507a497edd8a61735735b0277364d23cca348fd5ca3cc9a157420d0bdf6e0881f9734c834d17e70cacfe3ff98dbc75450b1"}}, @NL80211_ATTR_FRAME={0x1e, 0x33, @mgmt_frame=@disassoc={@wo_ht={{0x0, 0x0, 0xa, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {}, @device_b, @broadcast, @from_mac=@device_b, {0x6, 0x4af}}, 0x33, @void}}]}, 0x5f0}, 0x1, 0x0, 0x0, 0x80}, 0x40001) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc2(&(0x7f0000000780)='TIPCv2\x00', r4) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1680.861226] ion_buffer_destroy: buffer still mapped in the kernel 14:26:52 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee93}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0xa, 0x2, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:52 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) socketpair(0x2c, 0xa, 0x2, &(0x7f0000000040)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000001100)='TIPC\x00', 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x1c, r3, 0x20, 0x0, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r3, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x6, 0x2, @udp='udp:syz2\x00'}}}, ["", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x81) 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f0000000340)={0x6, "ceebb01c40453c780ce40f67d999376755fc8accfe786dee2fea22824378da44482f357d9ef7c6d3b4969e9e8d84fa418761a13cebda364629fe6aab8491601143bc402943043b87699fe524aba26a6d889d0e25af7b8ddc6034d39f86f65369c8e7a11dd405ad71de34313354feb471d2fd882af3c4e64ec11d34525b2349784fcad5c3949a1b6fa5cc405d25fdc89bacdbeb74fa7f7fc4e5e73ecd1b95ecd19b4303c6542e5863256ba526cd30cdf5bde58a16b03c7cc3bcbc15e8cb14712d1c32ce6d29ae8a3563e073a09af8682fb5aa2db10177333b470768b297913008254299278eb22a07a17a2d7aeaba09c662e332bb508a4a2ca9f369e8752fa921"}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000300)={0x401, 0x30, 0x1}) 14:26:52 executing program 1: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r0, 0x0, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x3f2, 0x300, 0x70bd26, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x408c1}, 0x4004000) socketpair(0x15, 0x4, 0x2, &(0x7f00000006c0)={0xffffffffffffffff}) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) sendto$phonet(r1, &(0x7f0000000240)="07bb0ae4891649107b46b7e525da54c76bc8daec750364123c9faec245deb918e52a491be9ee60564c2a328c90616d223b43a4dcb6ba2e5bdfc6269f7598200ce0e66c25b73a28cb954ba5bb908acb90938931bb00b9241ed9f2ccd002fdef06556d44acc0cdae53b875d6a57f33774d603bd9d4ab8a2085da3ad603d28ff75a7d083ffa2f4c9adddbe9dd96101cc2e45372fa6d6514a0fd157cf197fd39a7c788a29c3312e4498dda7b9bb9e3e34b8992380abd36105a8f0edf868183f102ee580b03b3425220b9ba137612e0f6fdd779a328028f0a206ef277a76e3756a5b40b92f70285e1c19d14ae0b3b84511eff36bdba6d539cce55fb13196bef8adcf874d2b90a011e2428b7e483d5681d592484d7a9635b99fa748a29399a3f527075dc418767d2a91121e45631bee67761008a6c84f2b821cc31e69c43fb357c9065b3e493db1d78cdd4bffe2e6e6622a85b7ab1aeb859db4cfe656fc4756bfe5a21bfb83e0a104e3ab009768e34f9edbbd9890e65f91675e21a40837cf337698375ca1e6f92b3f0d4167cca09290c5860d4205caad4a344f993ad0b3b9f3f215f7077da5782239804d77cff8a731905778d9e33c04c20e40c73a47cb13f296fc861ab304e6c2c051ec360c10b4f19b842422c0d23d98b51135eb70875d851d5e47e542769e839f26ebc555bbf885ebcd6360b66619bb5877926baf71c70aafcf29e7fcec692df30ede86b1f97eab2f3e61ec72db6387c48ecaf0b6daa5d7b2f527485930a612276804052e26bda2413b32d04cfcce1f713c4976c888457f647df06ee151332484153a9e19e9c727d86fd0b330e7af40a85ae2ef3424e14413ac7b017849637cea3ebc8441d55ea4fbfc5c5ea99a5b30e7461764fb839d412b305a003d32a4ee776cb2e44730f0c54a48cbfb96ffb264ce24bb3dca26a7ec22c6441ba8d81610fcb108edf53c7cb290ab1f3faa896583c47b7dec948d08d71090ccdfbe3df811acf38c4e87b223073a1bd299c8505f9f74c8af9fe36c4dddf1013bf4a6b085325262fee47959e86f414b938f14f94cffcdaf0833947f2bdc206845fd9a8997380fe1453a155b00053f58584d78a8cfca239bffcc8f1a11adbb4e23f29cbe1f88a9c02a7c3827f8a547806cb18ad959a6b43e573b7fa51a331cac7bebffcd152c2b9b1d94678c308a8154716c3a98367ce17974ebcfa0a8bfc5a7e71deec197b132fae66137618b6319b5e4c87c0e8f2d1c91776f27eb8953cc034a1067101785d1f9646cd80771f4b73b4900d88c5e270b3a8b2cb886e4589e50a3fa44c4a189e19b60bb20a11d0a06b88def26845db3c5cc976fea4c832ca842c70ac38b3a6a676f7c154587cc97a2ce296dc60dcf6f6fce97947656e5999f61688480c18b8eacb6306c30860d0353fe4341cf540ab971eb9ddf98334dda75485301348d2b76801b16c83c4bb0bc2399423939af4ba578c72b9d05395d9701c5631b525f6b802c1fd20bdd341bad31ef70e4c4da46c4a9dfbb9af385ad15f38f65bf28196cf8cd9ff3bce7783b05f0800d324209887d93be06bd063e86e059bb3c7e48a3b6297bc00026e54e5bd7fe378469e942495c3ffdfbad3bdd493e6840fe4df92210b69510a6a585d59dca8f0ed3971d352f98c21b702ce51d86d672b7aa2a621bb0e24c35d8a5167faeccb86f03e4e1e41559e4d48a94e011f520a681b9f6389a0147e28240e93538e18f19049160a51ecc11b08ec46798e2c8f7d80cde66906afc46dc22b2eec5772c3fe26b5cff74332649b367f3fa92d8623fd9a809fc29d564f77a7ad9930c04f5ee858477fd9a9a00eff1fdf7bb453512c14ce078f06731b0e8990515a34f283087a2d45f3b7ba1fed058cbafc5782b020cae7dd427955a0ca927a8b434f4ebf4ee51971e7ab875193a97c5d3882c13445b6e468d97bbe941886ee8f82c081633b638b1f8b517086de9c57b9c8f40f6fc1726122a211808daf32c5a6a23c5348280bed502891742c8d4e4fc5c264aa008ba66fafad35422515b33dfbfe7b92598182af413e4b29888a25bb121a855cf3f74749f8ce2b679954854cb35b2066b851ee69b4a3604c7b71de959e178d4be8cbd8263250880bca4ae1b24ebac7f1ad78033111da6f2fe81f781575f6b65b9cfba808655a1b425bd17e5241324abafd278e85797308077893ab411dab3df8f219e215c9f3b88d504785f6e134d3311ccb59f764e3f0e369110a730998bfa34b1dfe91b58dffcf7309b968937e04b853e65faf1cf937b90037e94c5785c6832c66a26a4a84307d3eb9945be8e0fc3dccf77f4a07fb747078eca5f8a75fd5565bd357babdd5b1482888a09a78779b35c943df696f6fefb6ecd84d2e7f56db9624a861024942aa2843b8674d8a9339e75a6094a742d3cecdcaff5193a9cb6163005f1c367625c8878c1f4725be816e6a1972dac08f976350fd5d5464078619f4f99ed5fe4d93358257e5c3e8fff774e62790bbc55fa323db05566c99b41d0b9f5f15a37dd4b7fb2b3d0de2d6a0c75db14768829946b4785d98f91ec6fb8f33690d088fa925ddfca81bf6bcd050b0fecc10e4a92c2cd345a44f6c50723d5ac300c19a4c26decee99fa8d6d435a2f5ef32664943b460add032340e3f39a83dab8bdc5080e04fde978e0978df96e5874616e215beeaea232ed18c3dd974d69d334e69e1c586da0d6e8f7e027cf653dc52595ed5019dae748fd0362d155b96cff94c55942abdabe9c48f807e53d872cea59ae40ac2d2e9f4c9fbbbed34c4860c546d2d1145fc80be9162e650ede0156a4dc49f64ea3bc2c8964e66297600edb390dd2b8bd3fc62a117f1ff3022fb0643d9621c058c2526df076110a53488aa64a17572ce006a7394e549f0b894679730b06520e1c4e4bc20e184b563c9f5f0252351a88eb17b68721b12b21d46d1221cf6ebbbfb72434d8529781afa8c5ae8ddfce797e90adb7cb4df0fef301e9f2c044c7078c4cb5d014efed2be21ec492c58508c2d0f52a90f7cf02b03b260816bf2f8a9b36ad6f95357e51021b5b9fc412280392fc42a88dda2b17f191134baa9aace501ac3d92a6acaf1d8a18975868f13809e765d66b72aae4303d9ef96a9d99b884d33b54446b7e2a2c5c76acbaa5e3952d10087750c57197208b550481da583492164ac5b4cf8f52e0a4f8b499440ebc0a898f71fa7117310bed706c3ee7789e85a200bf4436c525804ca4c5fa251e1dafe0b7e07d568d0084a1a77f3be1be44bfcd60675433e4162b048414b3d33f893b1c43c183a0a84a76da3fc8887765f903cc3824e4112cbc2196f06814d573c11ef8a91fac0d78208815ddde28b525cc3237853ae697ea08fe4665bcad3bc37a4ab851b429f15fd793cdfa1f78d108a0998f4b0a8995d87d9882522795c119f5c05b24314fbd650000107dd8609ad40ee911dd9f0575b234700eb698371156caa8fea66eab7f9546999af75bf177b7e45e6e8ba12c764fbe0771218293ee68426649eb39593254e70ac3da601b032a44f35e7bf715f3085ebff468ec41fbad9d1b3032a33365a6684ad0ccc819c7192441e7e9994cd1ca14346eced615abe71d63eef4bc8a02c31e2d9831d25d171f67bbf08cd50f1ca32cbc3374e3c7aca7051780d1b03f602d0a44800352261a780bd3215af78db03a0d30d961afd763a073dbbc7977fb1e32abdc24991018891319f2ef516b620a0dee3182792658deff3d236f278be22fe64e9809cfac262036d9cc48d4a00fec0f6822f9fa897e8b233dbb227a62c100b79998ba66bf39c79078a17012486618000c81afc93386ee6a927867a28b46d0b3a3236310908af7661dd2354b6c4eb05f82628ba9bbeeb70cc0b73f63a6421435526e42a739a9530df2edacf74ade9ea0b5e9261f7a342d3b3dd7efa12474f01e10404107a496eca8929eb76dc559e004b3f2536825210b0f130bb7be551bf7c60a41d3682963af547bf09f434927f82cff6a9434ec8840ac4c87c467dd9a70a3c3a8113806ce1fd1492b6256968fbeb30dbf3d449ca624c672856293557894e135fab135909740023625ec6bcdbeb033b2e870ea934536a6b2faaacfceb1ff0a829fe901a5081713befa83c68bcfd63611531c2e737f55b961e6101a5840b836763252c28300d4842709f3476e73edcce92089228b84bd88af714a8fbe55ee4898126f7de1f8acbaacd9fda2892330d9b1f9891fbdcc5e71a0c633f9756d9e97f3406cab129cf767a65ff249ed4c2a81ddd4c06a3cfab348de4e01de46f8439ea0d6670e8015083c244fb57eb69a37249e1f06e94ec5eda7518145261944ff26ae5ee9bf69ace8ff5d718768dacb5ba5dd7b63660c07dbf1cac5dbd89c7b7cef37c345044fefa2859f9af3bb8dc0a2df63b810fd89f26bacfc895e0589fc26270dde7c056e63bf49085a7f0be02732a925a4c9875b3c7e6d66152aa8f5c081ce614b1a4347aa549e62a3777fcedb551bc6b614dcc941bf2c3b4fdc4405fbecd07aa1566e448de7619c93411798087ac5775fa40299e6a1585fe3837b428cb699990dc9a93b04a7c77b8ec2b5f1b853cc8a1a9b95c6c0f7e9de1c018984b9098f61bbb93545ee03384de99ad409616cf6bafd4af619adb02512c8ca650afdf3b42a883b7fa3f48b2bea4e605a446f084010509f9a856e7faab48be230c5874dea57f13f9764463bfb8986dca164d9a4718929f8a5ae20b9a9b68ce53daafef0be0410229d0f5f15dedf67cd26b73b2c32d86dd2cf487d2ae06d7f3c18207deeb32fa4cfc58466aafe4bb3e7136f79f0ea196146a1267962c254b018c417d7ed3ceaf91cf2fafa90fa5e056863c0edfd7139057006db8846a116270b551a4f8f28c3d7fe1b9ae922f8479d9662c3b4aefa8fb7e5f304694469f6ff2696803cf9b0c028954499e9e8d78e4c5f4129f2b0698219f85cfe71ab5ac2164e9167e0c2d65c631c409ddde4a6e461d28d595aef2ad28dea3ca4ab97651e5df3f324b197d3391dbfcdf6fe21e72f061028e8e8baece4b3bac704518d3a9d34ce2ea022a790628fce819332192c74b22e7b540660ffd3e110ed63c2c7dcc1bd70420f036197b1f5c51b3295885ff9b8c6c279d580ce82c48a5f97b297e42ce136042efac9dd093f6c52d450a94f2022fde2a257a28cd2268e1e8b721dfc8f80da00585e909f390310b04e0f68b043ec18f38f737dbab85e5f190ad6ec5bb039ee04df4dcd35448e19cfe68e1dd63c09d28925bd1ee2e0d4d5781e06961f8195a3205ef9ebbcd90bbd4456c3b25cc465fb06cdc2d61f5589afe08118475efca8e55511abc121b4ac6d300753001dfe49961d6cccfc999c613fe5825d0a2ff6b0b5d879463b69cc38ec2eca9c0d23f86f659c0baf870f32dd1059a4a84671dab27152a59f8253eabe6cf5cbac2908b96feacfe6f3ef21bafe1585428b2bf738764bb3246d95d2bb8d1666db670b05c65c9189a36bfa2c850cebeeb8f2ca9b28c41dc1c07d89ab56ce443e5422de82328d3b7a73274aea2d98d9f1c153fb6dcb0263c379f041fa8e01cdf264b76d97735c224ed9fcc019c931a8bed107b92f4d2919c3e2802181dadaeb6e6810a5cbc37d5095300b70a593274d523d016e8b557822030714703e97b09a59deb8f4e1c378b9129a5fe4051e2facd3bdc986070cdd2a02eebaffc118727caadb1202a554550cb6331f2cfa2734a338c84df42635099ea05cfbf5c0618a8ccaceb55541cd8d13799d2830cb11a22bf0881ef604132f05f5c8f560472", 0x1000, 0x4, &(0x7f0000000040)={0x23, 0x6, 0x2, 0x9}, 0x10) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f00000000c0)={r3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0xc96, 0x1, 0x62b0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f00000000c0)={r4}) 14:26:52 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x2, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f0000000340)={0x6, "ceebb01c40453c780ce40f67d999376755fc8accfe786dee2fea22824378da44482f357d9ef7c6d3b4969e9e8d84fa418761a13cebda364629fe6aab8491601143bc402943043b87699fe524aba26a6d889d0e25af7b8ddc6034d39f86f65369c8e7a11dd405ad71de34313354feb471d2fd882af3c4e64ec11d34525b2349784fcad5c3949a1b6fa5cc405d25fdc89bacdbeb74fa7f7fc4e5e73ecd1b95ecd19b4303c6542e5863256ba526cd30cdf5bde58a16b03c7cc3bcbc15e8cb14712d1c32ce6d29ae8a3563e073a09af8682fb5aa2db10177333b470768b297913008254299278eb22a07a17a2d7aeaba09c662e332bb508a4a2ca9f369e8752fa921"}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000300)={0x401, 0x30, 0x1}) 14:26:52 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x6, 0x1ff, 0xee90}) r1 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x0, 0xd729}) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f00000000c0)=0x1b) shmctl$IPC_RMID(0x0, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x7) r2 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000080)={r3}) 14:26:52 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00', 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000001340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x20, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8}]}]}, 0x20}}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000000c0)={r4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0xc96, 0x1, 0x62b3}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000040)={r4}) r5 = syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000080)={0x9000, 0x7, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r5, 0xc01064b3, &(0x7f00000000c0)={r6}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r0, 0xc01064b3, &(0x7f0000000200)={r6}) 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f0000000340)={0x6, "ceebb01c40453c780ce40f67d999376755fc8accfe786dee2fea22824378da44482f357d9ef7c6d3b4969e9e8d84fa418761a13cebda364629fe6aab8491601143bc402943043b87699fe524aba26a6d889d0e25af7b8ddc6034d39f86f65369c8e7a11dd405ad71de34313354feb471d2fd882af3c4e64ec11d34525b2349784fcad5c3949a1b6fa5cc405d25fdc89bacdbeb74fa7f7fc4e5e73ecd1b95ecd19b4303c6542e5863256ba526cd30cdf5bde58a16b03c7cc3bcbc15e8cb14712d1c32ce6d29ae8a3563e073a09af8682fb5aa2db10177333b470768b297913008254299278eb22a07a17a2d7aeaba09c662e332bb508a4a2ca9f369e8752fa921"}) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000300)={0x401, 0x30, 0x1}) 14:26:52 executing program 4: socketpair(0xb, 0x4, 0x9, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x2c}, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x81, 0x67}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x18004c26a26dab38}, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00', r3) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000100)={0x1a0, r4, 0x4, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x85}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x1}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x17c, 0x3, 0x0, 0x1, [{0x78, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x73, 0x2, "ddd6c2ff360d26927b80d83090fff70d32a1b8b56d585cf8ae57e6bd34a4b6aaef8932d0eb3f3084d6ba64be94e8ed0d8c02e128f7687cd1ed9dd5481ea38f52e07a614db1179a90b52cbca2b31e9194fe8b63ca8b9ecec72cc25e0e25dec6beb6f4e1c79dec69b864119d026965b0"}}, {0x20, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0x19, 0x1, "c441176898c6db7898fc0fcfc38fe3884afb9b5de4"}}, {0xe0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xdb, 0x1, "f801a10b5d1ee6ea684d870ad7a8bfea1198674f345222a058e37772fd5b07db864234bf28b518b83bb57321629e67abbd53ea8e5124720a3de3ce0bd8a67a748017df184e6d771d6687c855d1b05c0dfcd8934c34637ca0901b0ec1c57c83378c80f78a0a422ac1f48f8f3712ee2783fec96a8b7ac86db369a22958c83cf2d3b481f3165fae96805b8bcad362fa50b3ec2779f0511c9d1a9895bc19df29ce735ce773a6b19bef6a87b3d9427170cb71197679d7bdf3262c19a6ff3b2e0a824ad30fe2f4738d8e51b920147a7e73728dde624e1defc2f7"}}]}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x24048840}, 0x800) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000080)={0x100000003, 0x3}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002180)='batadv\x00', 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r7, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f00000007c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000780)={&(0x7f0000000640)={0x13c, 0x0, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x54, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}]}, @TIPC_NLA_MEDIA={0xb8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x63}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x23}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$BATADV_CMD_SET_HARDIF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000500)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x3c, r6, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x64000000}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4) 14:26:52 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x3, 0x8000) r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x8001, 0x100000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) 14:26:52 executing program 5: r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x2, 0x0) msgctl$IPC_INFO(r0, 0x3, &(0x7f00000000c0)=""/4096) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) [ 1681.100100] ================================================================== [ 1681.107668] BUG: KASAN: use-after-free in vgem_gem_dumb_create+0x200/0x210 [ 1681.114679] Read of size 8 at addr ffff8880a1f466c0 by task syz-executor.2/11857 [ 1681.122202] [ 1681.123826] CPU: 0 PID: 11857 Comm: syz-executor.2 Not tainted 4.14.225-syzkaller #0 [ 1681.131700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1681.141045] Call Trace: [ 1681.143633] dump_stack+0x1b2/0x281 [ 1681.147266] print_address_description.cold+0x54/0x1d3 [ 1681.152543] kasan_report_error.cold+0x8a/0x191 [ 1681.157207] ? vgem_gem_dumb_create+0x200/0x210 [ 1681.161869] __asan_report_load8_noabort+0x68/0x70 [ 1681.166801] ? vgem_gem_dumb_create+0x200/0x210 [ 1681.171473] vgem_gem_dumb_create+0x200/0x210 [ 1681.175974] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1681.180990] ? __drm_printfn_debug+0x70/0x70 [ 1681.185392] drm_ioctl_kernel+0x14c/0x200 [ 1681.189541] drm_ioctl+0x419/0x870 [ 1681.193081] ? __drm_printfn_debug+0x70/0x70 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f0000000340)={0x6, "ceebb01c40453c780ce40f67d999376755fc8accfe786dee2fea22824378da44482f357d9ef7c6d3b4969e9e8d84fa418761a13cebda364629fe6aab8491601143bc402943043b87699fe524aba26a6d889d0e25af7b8ddc6034d39f86f65369c8e7a11dd405ad71de34313354feb471d2fd882af3c4e64ec11d34525b2349784fcad5c3949a1b6fa5cc405d25fdc89bacdbeb74fa7f7fc4e5e73ecd1b95ecd19b4303c6542e5863256ba526cd30cdf5bde58a16b03c7cc3bcbc15e8cb14712d1c32ce6d29ae8a3563e073a09af8682fb5aa2db10177333b470768b297913008254299278eb22a07a17a2d7aeaba09c662e332bb508a4a2ca9f369e8752fa921"}) 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) r3 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) ioctl$USBDEVFS_RESETEP(r3, 0x80045503, 0x0) 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x7fff, 0x0) [ 1681.197486] ? drm_getstats+0x20/0x20 [ 1681.201288] ? futex_exit_release+0x220/0x220 [ 1681.205778] ? __fget+0x1fe/0x360 [ 1681.209234] ? lock_downgrade+0x740/0x740 [ 1681.213378] ? drm_getstats+0x20/0x20 [ 1681.217181] do_vfs_ioctl+0x75a/0xff0 [ 1681.221155] ? ioctl_preallocate+0x1a0/0x1a0 [ 1681.225560] ? lock_downgrade+0x740/0x740 [ 1681.229707] ? __fget+0x225/0x360 [ 1681.233161] ? do_vfs_ioctl+0xff0/0xff0 [ 1681.237126] ? security_file_ioctl+0x83/0xb0 [ 1681.241532] SyS_ioctl+0x7f/0xb0 [ 1681.244895] ? do_vfs_ioctl+0xff0/0xff0 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x7, 0x1, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) [ 1681.248865] do_syscall_64+0x1d5/0x640 [ 1681.252755] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1681.257941] RIP: 0033:0x465f69 [ 1681.261126] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1681.268831] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1681.276093] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1681.283361] RBP: 00000000004bfa8f R08: 0000000000000000 R09: 0000000000000000 [ 1681.290713] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000240)=0x1) [ 1681.298001] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 [ 1681.305275] [ 1681.306895] Allocated by task 11857: [ 1681.310605] kasan_kmalloc+0xeb/0x160 [ 1681.314402] kmem_cache_alloc_trace+0x131/0x3d0 [ 1681.319060] __vgem_gem_create+0x44/0xe0 [ 1681.323115] vgem_gem_dumb_create+0xc5/0x210 [ 1681.327520] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1681.332531] drm_ioctl_kernel+0x14c/0x200 [ 1681.336670] drm_ioctl+0x419/0x870 [ 1681.340200] do_vfs_ioctl+0x75a/0xff0 [ 1681.343999] SyS_ioctl+0x7f/0xb0 [ 1681.347368] do_syscall_64+0x1d5/0x640 14:26:52 executing program 3: sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c8b010000009ac38ee18d000000", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25080000001c000380080003000000000008000300ff03000008000200000100004c00028034000380080001000080ffff0800020000000100080001006400000008000200e0ffffff08000200f9ffffff0800f5000000000008000100000000100400038008000100ffff0000"], 0x7c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x100000000, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}}, 0x2001) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00', r1) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x46000680) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000240)=0x1) [ 1681.351261] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1681.356436] [ 1681.358053] Freed by task 11857: [ 1681.361413] kasan_slab_free+0xc3/0x1a0 [ 1681.365379] kfree+0xc9/0x250 [ 1681.368468] drm_gem_object_free+0x8f/0x150 [ 1681.372776] drm_gem_object_put_unlocked+0xc3/0x160 [ 1681.377872] vgem_gem_dumb_create+0xf2/0x210 [ 1681.382272] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1681.387278] drm_ioctl_kernel+0x14c/0x200 [ 1681.391414] drm_ioctl+0x419/0x870 [ 1681.394952] do_vfs_ioctl+0x75a/0xff0 [ 1681.399093] SyS_ioctl+0x7f/0xb0 [ 1681.402453] do_syscall_64+0x1d5/0x640 [ 1681.406332] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1681.411504] [ 1681.413128] The buggy address belongs to the object at ffff8880a1f465c0 [ 1681.413128] which belongs to the cache kmalloc-512 of size 512 [ 1681.425778] The buggy address is located 256 bytes inside of [ 1681.425778] 512-byte region [ffff8880a1f465c0, ffff8880a1f467c0) [ 1681.437756] The buggy address belongs to the page: [ 1681.442720] page:ffffea000287d180 count:1 mapcount:0 mapping:ffff8880a1f460c0 index:0x0 [ 1681.450840] flags: 0xfff00000000100(slab) [ 1681.454967] raw: 00fff00000000100 ffff8880a1f460c0 0000000000000000 0000000100000006 [ 1681.462824] raw: ffffea00029794a0 ffffea00027c1ea0 ffff88813fe80940 0000000000000000 [ 1681.470677] page dumped because: kasan: bad access detected [ 1681.476360] [ 1681.477961] Memory state around the buggy address: [ 1681.482864] ffff8880a1f46580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 1681.490198] ffff8880a1f46600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1681.497567] >ffff8880a1f46680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1681.504955] ^ [ 1681.510380] ffff8880a1f46700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1681.517713] ffff8880a1f46780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1681.525048] ================================================================== [ 1681.532387] Disabling lock debugging due to kernel taint [ 1681.564162] Kernel panic - not syncing: panic_on_warn set ... [ 1681.564162] [ 1681.571762] CPU: 0 PID: 11857 Comm: syz-executor.2 Tainted: G B 4.14.225-syzkaller #0 [ 1681.580895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1681.590328] Call Trace: [ 1681.592893] dump_stack+0x1b2/0x281 [ 1681.596497] panic+0x1f9/0x42d [ 1681.599663] ? add_taint.cold+0x16/0x16 [ 1681.603613] ? ___preempt_schedule+0x16/0x18 [ 1681.607999] kasan_end_report+0x43/0x49 [ 1681.611946] kasan_report_error.cold+0xa7/0x191 [ 1681.616634] ? vgem_gem_dumb_create+0x200/0x210 [ 1681.621279] __asan_report_load8_noabort+0x68/0x70 [ 1681.626190] ? vgem_gem_dumb_create+0x200/0x210 [ 1681.630833] vgem_gem_dumb_create+0x200/0x210 [ 1681.635306] drm_mode_create_dumb_ioctl+0x221/0x2b0 [ 1681.640295] ? __drm_printfn_debug+0x70/0x70 [ 1681.644679] drm_ioctl_kernel+0x14c/0x200 [ 1681.648805] drm_ioctl+0x419/0x870 [ 1681.652355] ? __drm_printfn_debug+0x70/0x70 [ 1681.656739] ? drm_getstats+0x20/0x20 [ 1681.660517] ? futex_exit_release+0x220/0x220 [ 1681.664986] ? __fget+0x1fe/0x360 [ 1681.668415] ? lock_downgrade+0x740/0x740 [ 1681.672564] ? drm_getstats+0x20/0x20 [ 1681.676340] do_vfs_ioctl+0x75a/0xff0 [ 1681.680160] ? ioctl_preallocate+0x1a0/0x1a0 [ 1681.684585] ? lock_downgrade+0x740/0x740 [ 1681.688706] ? __fget+0x225/0x360 [ 1681.692167] ? do_vfs_ioctl+0xff0/0xff0 [ 1681.696114] ? security_file_ioctl+0x83/0xb0 [ 1681.700547] SyS_ioctl+0x7f/0xb0 [ 1681.703895] ? do_vfs_ioctl+0xff0/0xff0 [ 1681.707856] do_syscall_64+0x1d5/0x640 [ 1681.711859] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1681.717024] RIP: 0033:0x465f69 [ 1681.720192] RSP: 002b:00007f075074b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1681.727874] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 [ 1681.735159] RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000006 [ 1681.742404] RBP: 00000000004bfa8f R08: 0000000000000000 R09: 0000000000000000 [ 1681.749762] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 [ 1681.757005] R13: 00007ffcfbe0f59f R14: 00007f075074b300 R15: 0000000000022000 [ 1681.764740] Kernel Offset: disabled [ 1681.768345] Rebooting in 86400 seconds..